Cisco Cisco Email Security Appliance C170 Guia Do Utilizador

Message Filter Rules. Each filter has a rule that defines the collection of messages that the filter 
can act upon. You define those rules when you create a message filter. For more information, see 

Message Filter Actions. Each filter has an action that is performed on a message if the rule 
evaluates to 

true

. There are two types of actions that can be performed: final actions (such as 

delivering, dropping, or bouncing a message), or non-final actions (such as stripping or inserting a 
header) which permit the message to be further processed. For more information, see 

.

Attachment Scanning Message Filters. Attachment scanning message filters allow you to strip 
attachments from messages that are inconsistent with your corporate policies, while still retaining 
the ability to deliver the original message. You can filter attachments based on their specific file 
type, fingerprint, or content. You can also scan image attachments using an image analyzer. The 
image analyzer creates algorithms to measure skin color, body size and curvature to determine the 
probability that the graphic contains inappropriate content. For more information, see 

.

Using the CLI to Manage Message Filters. The CLI accepts commands for working with message 
filters. For example, you might want to display, reorder, import or export a list of message filters. 
For more information, see 

Message Filter Examples. This section contains some real world examples of filters with a brief 
discussion of each. For more information, see 

Message filters allow you to create special rules describing how to handle messages as they are received. 
A message filter is comprised of message filter rules and message filter actions. 

Message filter rules determine the messages that a filter will act on. Rules may be combined using the 
logical connectors AND, OR, and NOT to create more complex tests. Rule expressions may also be 
grouped using parentheses. 

The purpose of message filters is to perform actions on selected messages. 

The two types of actions are:

Final actions — such as 

deliver

, 

drop

, and 

bounce

 — end the processing of a message, and permit 

no further processing through subsequent filters.

Non-final actions perform an action which permits the message to be processed further.

Non-final message filter actions are cumulative. If a message matches multiple filters where 
each filter specifies a different action, then all actions are accumulated and enforced. However, 
if a message matches multiple filters specifying the same action, the prior actions are overridden 
and the final filter action is enforced.