Cisco Cisco Email Security Appliance C170 Guia Do Utilizador

This filter sends notification based on whether the subject contains specific 
words:

search_for_sensitive_content:

if (Subject == "(?i)plaintiff|lawsuit|judge" ) {

    notify ("admin@company.com");

}

This filter scans and blind copies messages that are sent to competitors. Note that 
you could use a dictionary and the header-dictionary-match() rule to specify a 
more flexible list of competitors (see 

):

competitorFilter:

if (rcpt-to == '@competitor1.com|@competitor2.com') {

    bcc-scan('legal@example.com');

}

Use this filter to block email from a specific address:

block_harrasing_user:

if (mail-from == "ex-employee@hotmail\\.com") {

    notify ("admin@company.com");