Cisco Cisco Email Security Appliance C170 Guia Do Utilizador

Use content filters to customize handling of messages beyond the standard routine handling by the other 
content security features such as anti-virus scanning or DLP. For example, you can use a content filter 
if the content warrants quarantining for later examination, or because corporate policy requires certain 
messages to be encrypted before delivery. 

Content filters are similar to message filters, except that they are applied later in the email pipeline — 
after message filtering, after a message has been “splintered” into a number of separate messages for 
each matching mail policy, (see 

 for more information), and after the 

message has undergone anti-spam and anti-virus scanning. 

A content filter scans either incoming or outgoing messages. You cannot define a filter that scans both 
types of messages. The Email Security appliance has a separate “master list” of content filters for each 
type of message. The master list also determines in which order the appliance runs the content filters. 
However, each individual mail policy determines which particular filters will be executed when a 
message matches the policy. 

Content filters scan messages on a per-user (sender or recipient) basis. 

Content filters have the following components: 

conditions that determine when the appliance uses a content filter to scan a message (optional)

actions that the appliance takes on a message (required)

action variables that the appliance can add to a message when modifying it (optional)