Cisco Cisco Email Security Appliance C170 Guia Do Utilizador

Some messages contain images that you may wish to scan for inappropriate content. You can use the 
image analysis engine to search for inappropriate content in email. Image analysis is not designed to 
supplement or replace your anti-virus and anti-spam scanning engines. Its purpose is to enforce 
acceptable use by identifying inappropriate content in email. Use the image analysis scanning engine to 
quarantine and analyze mail and to detect trends. 

After you configure your appliance for image analysis, you can use image analysis filter rules to perform 
actions on suspect or inappropriate emails. Image scanning allows you to scan the following types of 
attached files: BMP, JPG, TIF, PNG, GIF, TGA, and PCX. The image analyzer uses algorithms that 
measure skin color, body size and curvature to determine the probability that the graphic contains 
inappropriate content. When you scan image attachments, Cisco fingerprinting determines the file type, 
and the image analyzer uses algorithms to analyze the image content. If the image is embedded in 
another file, the Content Scanner extracts the file. The image analysis verdict is computed on the 
message as a whole. If the message does not include any images, the message receives a score of “0” 
which maps to a “clean” verdict. Therefore, a message without any images will receive a "clean" verdict.

drop-attachments-by-filetype 

(<fingerprint name>[,  

<optional comment>])

Drops all attachments on messages that match 
the given “fingerprint” of the file. Archive file 
attachments (zip, tar) will be dropped if they 
contain a file that matches. For more 
information, see 

drop-attachments-by-mimetype 

(<MIME type>[,  <optional 

>]) 

Drops all attachments on messages that have a 
given MIME type. This action does not attempt 
to ascertain the MIME type by file extension 
and so it also does not examine the contents of 
archives.

drop-attachments-by-size 

(<number>[, <optional 

>]) 

Drops all attachments on the message that, in 
raw encoded form, are equal to or greater than 
the size (in bytes) given. Note that for archive 
or compressed files, this action does not 
examine the uncompressed size, but rather the 
size of the actual attachment itself.

drop-attachments-where-contai

ns (<regular expression>[, 

<optional comment>]) 

Drops all attachments on message that contain 
the regular expression. Archive files (zip, tar) 
will be dropped if any of the files they contain 
match the regular expression pattern.

drop-attachments-where-dictio

nary-match(<dictionary name>)

This filter action strips attachments based on 
matches to dictionary terms. If the terms in the 
MIME parts considered to be an attachment 
match a dictionary term (and the user-defined 
threshold is met), the attachment is stripped 
from the email. See 

.