IronPort - advanced configuration guide

6-12
Table 6-2 Message Filter Rules
Rule Syntax Description
Attachment MIME
Type a
Attachment
Protected
Attachment
Unprotected
Attachment
Scanning a
Attachment
Scanning
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
Chapter 6 Using Message Filters to Enforce Email Policies
attachment-mimetype Does the message contain an attachment of a
specific MIME type? This rule is similar to the
attachment-type rule, except only the MIME
type given by the MIME attachment is evaluated.
(The appliance does not try to “guess” the type
of the file by its extension if there is no explicit
type given.) See Examples of Attachment
Scanning Message Filters, page 6-72.
attachment-protected Does the message contain an attachment that is
password protected? See Quarantining Protected
Attachments, page 6-74.
attachment-unprotected The attachment-unprotected filter condition
returns true if the scanning engine detects an
attachment that is unprotected. A file is
considered unprotected if the scanning engine
was able to read the attachment. A zip file is
considered to be unprotected if any of its
members is unprotected.
attachment-contains()
attachment-binary-contains(<
regular expression>)
Note — The attachment-unprotected filter
condition is not mutually exclusive of the
attachment-protected filter condition. It is
possible for both filter conditions to return true
when scanning the same attachment. This can
occur, for example, if a zip file contains both
protected and unprotected members.
See Detecting Unprotected Attachments,
page 6-75.
Does the message contain an attachment that
contains text or another attachment that matches
a specific pattern? Does the pattern occur the
minimum number of times you specified for the
threshold value?
This rule is similar to the body-contains() rule,
but it attempts to avoid scanning the entire
“body” of the message. That is, it attempts to
scan only that which the user would view as
being an attachment. See Examples of
Attachment Scanning Message Filters,
page 6-72.
Does the message contain an attachment with
binary data that matches a specific pattern?
This rule is like the attachment-contains ()
rule, but it searches specifically for patterns in
the binary data.
OL-25137-01