Cisco Cisco Email Security Appliance C170 Guia Do Utilizador
9-22
User Guide for AsyncOS 10.0 for Cisco Email Security Appliances
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Rules
Smart Identifier Syntax
When you use a smart identifier in a filter rule, enter the smart-identifier keyword in quotes within a filter
rule that scans the body or attachment file, as in the example below:
rule that scans the body or attachment file, as in the example below:
You can also use smart identifiers in content filters and as a part of content dictionaries.
Note
You cannot combine a smart identifier key word with a normal regular expression or another key word.
For example the pattern
For example the pattern
*credit|*ssn
would not be valid.
Note
To minimize on false positives using the *SSN smart identifier, it may be helpful to use the *ssn smart
identifier along with other filter criteria. One example filter that can be used is the “only-body-contains”
filter condition. This will only evaluate the expression to be true if the search string is present in all of
the message body mime parts. For example, you could create the following filter:
identifier along with other filter criteria. One example filter that can be used is the “only-body-contains”
filter condition. This will only evaluate the expression to be true if the search string is present in all of
the message body mime parts. For example, you could create the following filter:
SSN-nohtml: if only-body-contains(“*ssn”) { duplicate-quarantine(“Policy”);}
Description and Examples of Message Filter Rules
The following section describes the various message filter rules in use and their examples.
Related Topics
•
•
•
•
•
•
•
•
•
•
•
•
•
ID_Credit_Cards:
if(body-contains("*credit")){
notify("legaldept@example.com");
}
.