IronPort - advanced configuration guide

6-2
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
Chapter 6 Using Message Filters to Enforce Email Policies
Message Filter Rules. Each filter has a rule that defines the collection of messages that the filter
can act upon. You define those rules when you create a message filter. For more information, see
Message Filter Rules, page 6-9.
Message Filter Actions. Each filter has an action that is performed on a message if the rule
evaluates to true. There are two types of actions that can be performed: final actions (such as
delivering, dropping, or bouncing a message), or non-final actions (such as stripping or inserting a
header) which permit the message to be further processed. For more information, see Message Filter
Actions, page 6-42.
Attachment Scanning Message Filters. Attachment scanning message filters allow you to strip
attachments from messages that are inconsistent with your corporate policies, while still retaining
the ability to deliver the original message. You can filter attachments based on their specific file
type, fingerprint, or content. You can also scan image attachments using an image analyzer. The
image analyzer creates algorithms to measure skin color, body size and curvature to determine the
probability that the graphic contains inappropriate content. For more information, see Attachment
Scanning, page 6-65.
Using the CLI to Manage Message Filters. The CLI accepts commands for working with message
filters. For example, you might want to display, reorder, import or export a list of message filters.
For more information, see Using the CLI to Manage Message Filters, page 6-75.
Message Filter Examples. This section contains some real world examples of filters with a brief
discussion of each. For more information, see Message Filter Examples, page 6-97.
Components of a Message Filter
Message Filter Rules
Message Filter Actions
Message filters allow you to create special rules describing how to handle messages as they are received.
A message filter is comprised of message filter rules and message filter actions.
Message filter rules determine the messages that a filter will act on. Rules may be combined using the
logical connectors AND, OR, and NOT to create more complex tests. Rule expressions may also be
grouped using parentheses.
The purpose of message filters is to perform actions on selected messages.
The two types of actions are:
Final actions — such as deliver, drop, and bounce — end the processing of a message, and permit
no further processing through subsequent filters.
Non-final actions perform an action which permits the message to be processed further.
Note Non-final message filter actions are cumulative. If a message matches multiple filters where
each filter specifies a different action, then all actions are accumulated and enforced. However,
if a message matches multiple filters specifying the same action, the prior actions are overridden
and the final filter action is enforced.
OL-25137-01