IronPort - advanced configuration guide

Overview
OL-25137-01
CHAPTER
6
Using Message Filters to Enforce Email Policies
The Cisco IronPort appliance contains extensive content scanning and message filtering technology that
allows you to enforce corporate policies and act on specific messages as they enter or leave your
corporate networks.
This chapter contains information about the powerful combinations of features available for policy
enforcement: a content scanning engine, message filters, attachment filters, and content dictionaries.
This chapter contains the following sections:
Overview, page 6-1
Components of a Message Filter, page 6-2
Message Filter Processing, page 6-3
Message Filter Rules, page 6-9
Message Filter Actions, page 6-42
Attachment Scanning, page 6-65
Using the CLI to Manage Message Filters, page 6-75
Message Filter Examples, page 6-97
Message filters allow you to create special rules describing how to handle messages as they are received
by the Cisco IronPort appliance. A message filter specifies that a certain kind of email message should
be given special treatment. Cisco IronPort message filters also allow you to enforce corporate email
policy by scanning the content of messages for words you specify. This chapter contains the following
sections:
Components of a message filter. Message filters allow you to create special rules describing how
to handle messages as they are received. Filter rules identify messages based on message or
attachment content, information about the network, message envelope, message headers, or message
body. Filter actions generate notifications or allow messages to be dropped, bounced, archived, blind
carbon copied, or altered. For more information, see Components of a Message Filter, page 6-2.
Processing Message Filters. When AsyncOS processes message filters, the content that AsyncOS
scans, the order of the processing, and the actions taken are based on several factors, including the
message filter order, any prior processing that may have altered the message content, the MIME
structure of the message, the threshold score configured for content matching, and structure of the
query. For more information, see Message Filter Processing, page 6-3.
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
6-1