IronPort - advanced configuration guide

Message Filter Order
6-4
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
Chapter 6 Using Message Filters to Enforce Email Policies
Message filter order. Message filters are maintained in an ordered list. When a message is
processed, AsyncOS applies each message filter in the order it appears in the list. If a final action
occurs, no further action is taken on the message. For more information, see Message Filter Order,
page 6-4.
Prior processing. Actions performed on AsyncOS messages may add or remove headers before the
message filter is evaluated. AsyncOS processes the message filter process on the headers that are
present in the message at the time of processing. For more information, see Message Header Rules
and Evaluation, page 6-4.
The MIME structure of the message. The MIME structure of the message determines which part
of the message is treated as “body,” and which part of the message is treated as an “attachment”.
Many message filters are configured to act on just the body or just the attachment part of the
message. For more information, see Message Bodies vs. Message Attachments, page 6-5.
The threshold score configured for the regular expression. When you match a regular expression,
you configure a “score” to tally up the number of times a match must occur before a filter action is
taken. This allows you to “weight” the responses to different terms. For more information, see
Thresholds for Matches in Content Scanning, page 6-6.
The structure of the query. When evaluating AND or OR tests within message filters, AsyncOS
does not evaluate unneeded tests. In addition, it is important to note that the system does not evaluate
the tests from left to right. Instead, when AND and OR tests are evaluated, the least expensive test
is evaluated first. For more information, see AND Test and OR Tests in Message Filters, page 6-8.
Message filters are kept in an ordered list and numbered by their position in the list. When a message is
processed, the message filters are applied in the associated numeric order. Therefore, filter number 30
will not have a chance to alter the source host of a message if filter number 9 has already executed a final
action on (for example, bounced) the message. The position of a filter in the list can be changed via the
system user interfaces. Filters imported via a file are ordered based on their relative order in the imported
file.
After a final action, no further actions may be taken on the message.
Although a message may match a filter rule, the filter may not act upon that message for any of the
following reasons:
The filter is inactive.
The filter is invalid.
The filter has been superseded by an earlier filter that executed a final action for the message.
Message Header Rules and Evaluation
Filters evaluate “processed” headers rather than the original message headers when applying header
rules. Thus:
If a header was added by a previous processing action, it can now be matched by any subsequent
header rule.
If a header was stripped by a previous processing action, it can no longer be matched by any
subsequent header rule.
OL-25137-01