Cisco Cisco Email Security Appliance C170 Guia Do Utilizador
9-31
AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Rules
Body Scanning Rule
The
body-contains()
rule scans the incoming email and all its attachments for a particular pattern
defined by its parameter. This includes delivery-status parts and associated attachments. The
body-contains()
rule does not perform multi-line matching. The scanning logic can be modified on the
Scan Behavior page or using the
scanconfig
command in the CLI to define which MIME types should
or should not be scanned. You can also specify a minimum number of matches that the scanning engine
must find in order for the scan to evaluate to true.
must find in order for the scan to evaluate to true.
By default, the system scans all attachments except for those with a MIME type of
video/*
,
audio/*
,
image/*
. The system scans archive attachments —
.zip
,
.bzip
,
.compress
,
.tar
, or
.gzip
attachments
containing multiple files. You can set the number of “nested” archived attachments to scan (for example,
a
a
.zip
contained within a
.zip
).
For more information, see
.
Body Scanning
When AsyncOS performs body scanning, it scans the body text and attachments for the regular
expression. You can assign a minimum threshold value for the expression, and if the scanning engine
encounters the regular expression the minimum number of times, the expression evaluates to
expression. You can assign a minimum threshold value for the expression, and if the scanning engine
encounters the regular expression the minimum number of times, the expression evaluates to
true
.
AsyncOS evaluates the different MIME parts of the message, and it scans any MIME part that is textual.
AsyncOS identifies the text parts if the MIME type specifies text in the first part. AsyncOS determines
the encoding based on the encoding specified in the message, and it converts the text to Unicode. It then
searches for the regular expression in Unicode space. If no encoding is specified in the message,
AsyncOS uses the encoding you specify on the Scan Behavior page or using the
AsyncOS identifies the text parts if the MIME type specifies text in the first part. AsyncOS determines
the encoding based on the encoding specified in the message, and it converts the text to Unicode. It then
searches for the regular expression in Unicode space. If no encoding is specified in the message,
AsyncOS uses the encoding you specify on the Scan Behavior page or using the
scanconfig
command.
For more information about how AsyncOS evaluates MIME parts when scanning messages, see
.
If the MIME part is not textual, AsyncOS extract files from a .zip or .tar archive or decompresses
compressed files. After extracting the data, a scanning engine identifies the encoding for the file and
returns the data from the file in Unicode. AsyncOS then searches for the regular expression in Unicode
space.
compressed files. After extracting the data, a scanning engine identifies the encoding for the file and
returns the data from the file in Unicode. AsyncOS then searches for the regular expression in Unicode
space.
The following example searches the body text and attachment for the phrase “Company Confidential.”
The example specifies a minimum threshold of two instances, so if the scanning engine finds two or more
instances of the phrase, it bounces any matching messages, and notifies the legal department of the
attempt:
The example specifies a minimum threshold of two instances, so if the scanning engine finds two or more
instances of the phrase, it bounces any matching messages, and notifies the legal department of the
attempt:
To scan only the body of the message, use
only-body-contains
:
ConfidentialFilter:
if (body-contains('Company Confidential',2)) {
notify ('legaldept@example.domain');
bounce();
}
disclaimer:
if (not only-body-contains('[dD]isclaimer',1) ) {