IronPort - advanced configuration guide

6-14
Table 6-2 Message Filter Rules
Rule Syntax Description
Header Dictionary
Match
Body Dictionary
Match
Envelope Recipient
Dictionary Match
Envelope Sender
Dictionary Match
SMTP
Authenticated User
Match
header-dictionary-match(, )
body-dictionary-match()
rcpt-to-dictionary-match()
mail-from-dictionary-match(<
dictionary_name>)
smtp-auth-id-matches( [, ])
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
Chapter 6 Using Message Filters to Enforce Email Policies
Does the specified header (case insensitive)
contain any of the regular expressions or terms in
the content dictionary named dictionary name?
See Dictionary Rules, page 6-33.
This filter condition returns true if the dictionary
term matches content in the body of the message
only. The filter searches for terms within the
MIME parts not considered to be an attachment.
and it returns true if the user-defined threshold is
met (the default threshold value is one). See
Dictionary Rules, page 6-33.
Does the envelope recipient contain any of the
regular expressions or terms in the content
dictionary named dictionary name? See
Dictionary Rules, page 6-33.
Does the envelope sender contain any of the
regular expressions or terms in the content
dictionary named dictionary name? See
Dictionary Rules, page 6-33.
Does the address of the Envelope Sender and the
address in message header match the
authenticated SMTP user ID of the sender? See
SMTP Authenticated User Match Rule,
page 6-37.
True true Matches all messages. See True Rule, page 6-20.
Valid valid Returns false if the message contains
unparsable/invalid MIME parts and true
otherwise. See Valid Rule, page 6-20.
Signed signed Is the message is signed? See Signed Rule,
page 6-39.
Signed Certificate signed-certificate(
[ ])
Does the message signer or X.509 certificate
issuer match a certain pattern? See Signed
Certificate Rule, page 6-39.
a.Attachment filtering is discussed in detail in the section Attachment Scanning, page 6-65.
b.Content Dictionaries are discussed in the detail in the “Text Resources” chapter in the Cisco IronPort
AsyncOS for Email Configuration Guide.
Each message injected into the Cisco IronPort appliance is processed through all message filters in order,
unless you specify a final action, which stops the message from being processed further. (See Message
Filter Actions, page 6-2.) Filters may also apply to all messages, and rules may also be combined using
logical connectors (AND, OR, NOT).
OL-25137-01