Cisco Cisco Email Security Appliance C170 Guia Do Utilizador

Message filter order. Message filters are maintained in an ordered list. When a message is 
processed, AsyncOS applies each message filter in the order it appears in the list. If a final action 
occurs, no further action is taken on the message. For more information, see 

Prior processing. Actions performed on AsyncOS messages may add or remove headers before the 
message filter is evaluated. AsyncOS processes the message filter process on the headers that are 
present in the message at the time of processing. For more information, see 

The MIME structure of the message. The MIME structure of the message determines which part 
of the message is treated as “body,” and which part of the message is treated as an “attachment”. 
Many message filters are configured to act on just the body or just the attachment part of the 
message. For more information, see 

.

The threshold score configured for the regular expression. When you match a regular expression, 
you configure a “score” to tally up the number of times a match must occur before a filter action is 
taken. This allows you to “weight” the responses to different terms. For more information, see 

.

The structure of the query. When evaluating AND or OR tests within message filters, AsyncOS 
does not evaluate unneeded tests. In addition, it is important to note that the system does not evaluate 
the tests from left to right. Instead, when AND and OR tests are evaluated, the least expensive test 
is evaluated first. For more information, see 

.

Message filters are kept in an ordered list and numbered by their position in the list. When a message is 
processed, the message filters are applied in the associated numeric order. Therefore, filter number 30 
will not have a chance to alter the source host of a message if filter number 9 has already executed a final 
action on (for example, bounced) the message. The position of a filter in the list can be changed via the 
system user interfaces. Filters imported via a file are ordered based on their relative order in the imported 
file.

After a final action, no further actions may be taken on the message. 

Although a message may match a filter rule, the filter may not act upon that message for any of the 
following reasons:

The filter is inactive. 

The filter is invalid. 

The filter has been superseded by an earlier filter that executed a final action for the message. 

Filters evaluate “processed” headers rather than the original message headers when applying header 
rules. Thus:

If a header was added by a previous processing action, it can now be matched by any subsequent 
header rule.

If a header was stripped by a previous processing action, it can no longer be matched by any 
subsequent header rule.