Cisco Cisco Email Security Appliance C190 Guia Do Utilizador
9-12
Cisco AsyncOS 8.0.1 for Email User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Rules
Attachment MIME
Type
Type
a
attachment-mimetype
Does the message contain an attachment of a
specific MIME type? This rule is similar to the
specific MIME type? This rule is similar to the
attachment-type
rule, except only the MIME
type given by the MIME attachment is evaluated.
(The appliance does not try to “guess” the type
of the file by its extension if there is no explicit
type given.) See
(The appliance does not try to “guess” the type
of the file by its extension if there is no explicit
type given.) See
Attachment
Protected
Protected
attachment-protected
Does the message contain an attachment that is
password protected? See
password protected? See
.
Attachment
Unprotected
Unprotected
attachment-unprotected
The attachment-unprotected filter condition
returns true if the scanning engine detects an
attachment that is unprotected. A file is
considered unprotected if the scanning engine
was able to read the attachment. A zip file is
considered to be unprotected if any of its
members is unprotected.
returns true if the scanning engine detects an
attachment that is unprotected. A file is
considered unprotected if the scanning engine
was able to read the attachment. A zip file is
considered to be unprotected if any of its
members is unprotected.
Note — The attachment-unprotected filter
condition is not mutually exclusive of the
attachment-protected filter condition. It is
possible for both filter conditions to return true
when scanning the same attachment. This can
occur, for example, if a zip file contains both
protected and unprotected members.
condition is not mutually exclusive of the
attachment-protected filter condition. It is
possible for both filter conditions to return true
when scanning the same attachment. This can
occur, for example, if a zip file contains both
protected and unprotected members.
See
Attachment
Scanning
Scanning
a
attachment-contains(<regular
expression>)
Does the message contain an attachment that
contains text or another attachment that matches
a specific pattern? Does the pattern occur the
minimum number of times you specified for the
threshold value?
contains text or another attachment that matches
a specific pattern? Does the pattern occur the
minimum number of times you specified for the
threshold value?
This rule is similar to the
body-contains()
rule,
but it attempts to avoid scanning the entire
“body” of the message. That is, it attempts to
scan only that which the user would view as
being an attachment. See
“body” of the message. That is, it attempts to
scan only that which the user would view as
being an attachment. See
Attachment
Scanning
Scanning
attachment-binary-contains(<
regular expression>)
Does the message contain an attachment with
binary data that matches a specific pattern?
binary data that matches a specific pattern?
This rule is like the
attachment-contains ()
rule, but it searches specifically for patterns in
the binary data.
the binary data.
Table 9-2
Message Filter Rules
Rule Syntax
Description