IronPort - advanced configuration guide

Chapter 6 Using Message Filters to Enforce Email Policies
OL-25137-01
Table 6-2 Message Filter Rules
Rule Syntax Description
Workqueue count workqueue-count Is the work queue count equal to, less than, or
greater than the specified value? See
Workqueue-count Rule, page 6-37.
Body Scanning body-contains()
Body Scanning only-body-contains()
Encryption
Detection
Attachment
Filename a
Does the message contain text or an attachment
that matches a specified pattern? Does the
pattern occur the minimum number of times you
specified for the threshold value?
The engine scans delivery-status parts and
associated attachments.
See Body Scanning Rule, page 6-28.
Does the message body contain text that matches
a specified pattern? Does the pattern occur the
minimum number of times you specified for the
threshold value? Attachments are not scanned.
See Body Scanning, page 6-29.
encrypted Is the message encrypted? See Encryption
Detection Rule, page 6-29.
attachment-filename Does the message contain an attachment with a
filename that matches a specific pattern? See
Attachment Filename Rule, page 6-30.
Attachment Type a attachment-type Does the message contain an attachment of a
particular MIME type? See Attachment Type
Rule, page 6-30.
Attachment File a
Type
attachment-filetype Does the message contain an attachment of a file
type that matches a specific pattern based on its
fingerprint (similar to a UNIX file command)?
If the attachment is an Excel or Word document,
you can also search for the following embedded
file types: .exe , .dll, .bmp, .tiff, .pcx, .gif, .jpeg,
png, and Photoshop images.
You must enclose the file type in quotes to create
a valid filter. You can use single or double
quotes. For example, to search for .exe
attachments, use the following syntax:
if (attachment-filetype == "exe")
For more information, see Examples of
Attachment Scanning Message Filters,
page 6-72.
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
6-11