IronPort - advanced configuration guide

Chapter 6 Using Message Filters to Enforce Email Policies
OL-25137-01
Table 6-2 Message Filter Rules
Rule Syntax Description
Attachment
Scanning
every-attachment-contains()
Do all of the attachments in this message contain
text that matches a specific pattern? The text
must exist in all attachments and the action
performed is, in effect, a logical AND operation
of an 'attachment-contains()' for each
attachment. The body is not scanned. Does the
pattern occur the minimum number of times you
specified for the threshold value?
See Examples of Attachment Scanning Message
Filters, page 6-72.
Attachment Size a attachment-size Does the message contain an attachment whose
size is within some range? This rule is similar to
the body-size rule, but it attempts to avoid
scanning the entire “body” of the message. That
is, it attempts to scan only that which the user
would view as being an attachment. The size is
evaluated prior to any decoding. See Examples
of Attachment Scanning Message Filters,
page 6-72.
Public Blacklists dnslist() Does the sender’s IP address appear on a public
blacklist server (RBL)? See DNS List Rule,
page 6-31.
SenderBase
Reputation
No SenderBase
Reputation
reputation What is the sender’s SenderBase Reputation
Score? See SenderBase Reputation Rule,
page 6-32.
no-reputation Used to test if SenderBase Reputation Score is
“None.” See SenderBase Reputation Rule,
page 6-32.
Dictionary b dictionary-match()
Attachment
Dictionary Match
Subject Dictionary
Match
attachment-dictionary-match(
)
subject-dictionary-match()
Does the message body contain any of the
regular expressions or terms in the content
dictionary named dictionary_name? Does the
pattern occur the minimum number of times you
specified for the threshold value? See Dictionary
Rules, page 6-33.
Does the attachment contain any of the regular
expressions in the content dictionary named
dictionary_name? Does the pattern occur the
minimum number of times you specified for the
threshold value? See Dictionary Rules,
page 6-33.
Does the Subject header contain any of the
regular expressions or terms in the content
dictionary named dictionary name? See
Dictionary Rules, page 6-33.
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
6-13