IronPort - advanced configuration guide

Chapter 6 Using Message Filters to Enforce Email Policies
Message Filter Rules
OL-25137-01
In a somewhat more complicated example, consider:
The system groups the expression from left to right, so this becomes:
This means the first thing the system does is compare the cost of (test1 AND test2) against the cost of
test3, evaluating the second AND first. If all three tests have the same cost, then test3 will be
performed first because (test1 AND test2) would be twice as expensive.
Each message filter contains a rule that defines the collection of messages that a filter can act upon. You
define the filter rules, and then you define a filter action for messages that return true.
Filter Rules Summary Table
if (test1 AND test2 AND test3) { ... }
if ((test1 AND test2) AND test3) { ... }
Table 6-2 summarizes the rules you can use in message filters.
Table 6-2 Message Filter Rules
Rule Syntax Description
Subject Header subject Does the subject header match a certain pattern?
See Subject Rule, page 6-21.
Body Size body-size Is the body size within some range? See Body
Size Rule, page 6-24.
Envelope Sender mail-from Does the Envelope Sender (i.e., the Envelope
From, ) match a given pattern?
See Envelope Sender Rule, page 6-22.
Envelope Sender in
Group
mail-from-group Is the Envelope Sender (i.e., the Envelope From,
) in a given LDAP group? See
Envelope Sender in Group Rule, page 6-23.
Sender Group sendergroup Which sender group was matched in a listener's
Host Access Table (HAT)? See Sender Group
Rule, page 6-23.
Envelope Recipient rcpt-to Does the Envelope Recipient, (i.e. the Envelope
To, ) match a given pattern? See
Envelope Recipient Rule, page 6-21.
Note: The rcpt-to rule is message-based. If a
message has multiple recipients, only one
recipient has to match the rule for the specified
action to affect the message to all recipients.
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
6-9