Cisco Cisco Email Security Appliance C170 Guia Do Utilizador
Chapter 6 Using Message Filters to Enforce Email Policies
6-440
Cisco IronPort AsyncOS 7.3 for Email Advanced Configuration Guide
OL-23081-01
Alter SRBS Filter
Alter the (SenderBase Reputation Score) SBRS threshold for certain domains:
mod_sbrs:
if ( (rcpt-count == 1) AND (rcpt-to == "@domain\\.com$") AND (reputation
< -2) ) {
drop ();
}
Filename Regex Filter
This filter specifies a range of size for the body of the message, and looks for an
attachment that matches the regular expression (this matches files named
“readme.zip”, “readme.exe”, “attach.exe”, and so forth.):
attachment that matches the regular expression (this matches files named
“readme.zip”, “readme.exe”, “attach.exe”, and so forth.):
filename_filter:
if ((body-size >= 9k) AND (body-size <= 20k)) {
if (body-contains ("(?i)(readme|attach|information)\\.(zip|exe)$")) {
drop ();
}
}
Show SenderBase Reputation Score in Header Filter
Remember to log the headers (see “Logging” in the Cisco IronPort AsyncOS for
Email Daily Management Guide) so they appear in the mail log:
Email Daily Management Guide) so they appear in the mail log:
Check_SBRS:
if (true) {