Руководство Пользователя для Cisco Cisco Email Security Appliance C160
11-9
Cisco AsyncOS 8.0.1 for Email User Guide
Chapter 11 Content Filters
How Content Filters Work
Content Filter Actions
The action is what the Email Security appliance does with a message that matches the content filter’s
condition. Many different types of actions are available, including modifying the message, quarantining
it, or dropping it. A “final action” performed on a message, delivering or dropping it, forces the Email
Security appliance to perform the action immediately and forgo all further processing, such as Outbreak
Filter or DLP scanning.
condition. Many different types of actions are available, including modifying the message, quarantining
it, or dropping it. A “final action” performed on a message, delivering or dropping it, forces the Email
Security appliance to perform the action immediately and forgo all further processing, such as Outbreak
Filter or DLP scanning.
At least one action must be defined for each content filter.
Actions are performed in order on messages, so consider the order of actions when defining multiple
actions for a content filter.
actions for a content filter.
When you configure a quarantine action for messages that match Attachment Content conditions,
Message Body or Attachment conditions, Message body conditions, or the Attachment content
conditions, you can view the matched content in the quarantined message. When you display the
message body, the matched content is highlighted in yellow. You can also use the
Message Body or Attachment conditions, Message body conditions, or the Attachment content
conditions, you can view the matched content in the quarantined message. When you display the
message body, the matched content is highlighted in yellow. You can also use the
$MatchedContent
action variable to include the matched content in the message subject. For more information, see Cisco
IronPort AsyncOS for Email Advanced Configuration Guide.
IronPort AsyncOS for Email Advanced Configuration Guide.
Only one final action may be defined per filter, and the final action must be last action listed. Bounce,
deliver, and drop are final actions. When entering actions for content filters, the GUI and CLI will force
final actions to be placed last.
deliver, and drop are final actions. When entering actions for content filters, the GUI and CLI will force
final actions to be placed last.
Table 11-3
Content Filter Actions
Action
Description
Quarantine
Quarantine. Flags the message to be held in one of the policy quarantine
areas.
areas.
Duplicate message: Sends a copy of the message to the specified quarantine
and continues processing the original message. Any additional actions apply
to the original message.
and continues processing the original message. Any additional actions apply
to the original message.
Encrypt on Delivery
The message continues to the next stage of processing. When all processing
is complete, the message is encrypted and delivered.
is complete, the message is encrypted and delivered.
Encryption rule: Always encrypts the message or only encrypts it if an
attempt to send it over a TLS connection first fails. See
attempt to send it over a TLS connection first fails. See
for more information.
Encryption Profile. Once processing is complete, encrypts the message
using the specified encryption profile, then delivers the message. This action
is for use with a Cisco Encryption Appliance or a hosted key service.
using the specified encryption profile, then delivers the message. This action
is for use with a Cisco Encryption Appliance or a hosted key service.
Subject. Subject for the encrypted message. By default, the value is
$Subject
.