Cisco Cisco Email Security Appliance C170 Guia Do Utilizador

You can use filters to search for strings and patterns in non-ASCII encoded message content (both 
headers and bodies). Specifically, the system supports regular expression (regex) searching for 
non-ASCII character sets within: 

Message headers

MIME attachment filename strings 

Message body: 

Bodies without MIME headers (i.e. traditional email) 

Rules containing an asterisk (

*

) match “zero or more matches of the 

previous directive.” In particular, the sequence of a period and an 
asterisk (

.*

) matches any sequence of characters (not containing a new 

line). 

For example, the regular expression 

^P.*Piper$ 

matches all of these 

strings: 

PPiper

,

 Peter Piper

,

 P.Piper

,

 

and

 Penelope Penny Piper

. 

The backslash character escapes special characters. Thus the sequence

 

\. 

only matches a literal period, the sequence

 \$

 only matches a literal 

dollar sign, and the sequence 

\^

 only matches a literal caret symbol. 

For example, the regular expression 

^ik\.ac\.uk$

 only matches the 

string 

ik.ac.uk

.

Important Note: The backslash is also a special escape character for 
the parser. As a result, if you want to include backslash in your regular 
expression, you must use two backslashes — so that after parsing, only 
one “real” backslash remains, which is then passed to the regular 
expression system. So, if you wanted to match the example domain 
above, you would enter 

^ik\\.ac\\.uk$

. 

The token 

(?i)

 that indicates the rest of the regular expression should 

be treated in case-insensitive mode. Placing this token at the beginning 
of a case-sensitive regular expression results in a completely 
insensitive match.

For example, the regular expression “

(?i)viagra

” matches 

Viagra

, 

vIaGrA

, and 

VIAGRA

.

The regular expression notation that indicates the number of repetitions 
of the previous token is supported. 

For example, the expression “

fo{2,3}

” matches 

foo

 and 

fooo

 but not 

fo

 or 

fofo

.

This statement: 

if(header('To') == "^.{500,}")

looks for a “To” 

header that has 500 or more characters in it. 

Alternation, or the “or” operator. If A and B are regular expressions, the 
expression “

A|B

” will match any string that matches either “A” or “B.” 

For example, the expression “

foo|bar

” will match either 

foo

 or 

bar

, 

but not 

foobar

.