Cisco Cisco Email Security Appliance C170 Guia Do Utilizador

For the special Outbreak quarantine, additional functionality is available. See 

 for more information.

When you configure a quarantine action for messages that match Attachment Content conditions, 
Message Body or Attachment conditions, Message body conditions, or the Attachment content 
conditions, you can view the matched content in the quarantined message. When you display the 
message body, the matched content is highlighted in yellow, except for DLP policy violation matches. 
You can also use the 

$MatchedContent

 action variable to include the matched content from message or 

content filter matches in the message subject. 

If the attachment contains the matched content, the attachment’s contents are displayed as well as the 
reason it was quarantined, whether it was due to a DLP policy violation, content filter condition, message 
filter condition, or Image Analysis verdict.

When you view messages in the local quarantine that have triggered message or content filter rules, the 
GUI may display content that did not actually trigger the filter action (along with content that triggered 
the filter action). The GUI display should be used as a guideline for locating content matches, but does 
not necessarily reflect an exact list of content matches. This occurs because the GUI uses less strict 
content matching logic than is used in the filters. This issue applies only to the highlighting in the 
message body. The table that lists the matched strings in each part of the message along with the 
associated filter rule is correct.

You can download a message attachment by clicking the attachment’s file name in the Message Parts or 
Matched Content section. AsyncOS displays a warning that attachments from unknown sources may 
contain viruses and asks you if you want to continue. You can also download the message body by 
clicking 

[message body]

 in the Message Parts section.