Cisco Cisco Email Security Appliance C160 用户指南
9-52
AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Actions
Attachment Groups
You can specify a particular file type (“exe” files for example) or common groups of attachments in the
attachment-filetype
and
drop-attachments-by-filetype rules
. AsyncOS divides the attachments
into the groups listed in
If you create a message filter that uses the
!=
operator to match a message that does not contain an
attachment with a specific file type, the filter will not perform any action on the message if there is at
least one attachment with the file type you want to filter out. For example, the following filter drops any
message with an attachment that is not an
least one attachment with the file type you want to filter out. For example, the following filter drops any
message with an attachment that is not an
.exe
file type:
If a message has multiple attachments, the Email Security appliance does not drop the message if at least
one of the attachments is an
one of the attachments is an
.exe
file, even if the other attachments not
.exe
files.
exe_check: if (attachment-filetype != "exe") {
drop();
}
Table 9-6
Attachment Groups
Attachment Group Name
Scanned File Types
Document
•
doc
•
docx
•
mdb
•
mpp
•
ole
•
pdf
•
ppt
•
pptx
•
rtf
•
wps
•
x-wmf
•
xls
•
xlsx
Executable
•
exe
•
java
•
msi
•
pif
Note
Filtering the Executable group will also scan
.dll
and
.scr
files, but you cannot filter these file types
individually.