IronPort - advanced configuration guide

Chapter 6 Using Message Filters to Enforce Email Policies
Regular Expressions in Rules
OL-25137-01
Several of the atomic tests used to define rules use regular expression matching. Regular expressions can
become complex. Use the following table as a guide for the applying of regular expressions within
message filter rules:
Table 6-3 Regular Expression in Rules
Regular expression (abc) Regular expressions in filter rules match a string if the sequence of
directives in the regular expression match any part of the string.
Carat (^)
Dollar sign ($)
Letters, white space and the at
sign (@) character
For example, the regular expression Georg matches the string George
Of The Jungle, the string Georgy Porgy, the string La Meson
Georgette as well as Georg.
Rules containing the dollar sign character ($) only match the end of the
string, and rules containing the caret symbol (^) only match the
beginning of the string.
For example, the regular expression ^Georg$ only matches the string
Georg.
Searching for an empty header would look like this: "^$"
Rules containing characters, white space, and the at sign character (@)
only match themselves explicitly.
For example, the regular expression ^George@admin$ only matches the
string George@admin.
Period character (.) Rules containing a period character (.) match any character (except a
new line).
For example, the regular expression ^...admin$ matches the string
macadmin as well as the string sunadmin but not win32admin.
Asterisk (*) directive Rules containing an asterisk (*) match “zero or more matches of the
previous directive.” In particular, the sequence of a period and an
asterisk (.*) matches any sequence of characters (not containing a new
line).
For example, the regular expression ^P.*Piper$ matches all of these
strings: PPiper, Peter Piper, P.Piper, and Penelope Penny Piper.
Backslash special characters (\) The backslash character escapes special characters. Thus the sequence
\. only matches a literal period, the sequence \$ only matches a literal
dollar sign, and the sequence \^ only matches a literal caret symbol.
For example, the regular expression ^ik\.ac\.uk$ only matches the
string ik.ac.uk.
Important Note: The backslash is also a special escape character for
the parser. As a result, if you want to include backslash in your regular
expression, you must use two backslashes — so that after parsing, only
one “real” backslash remains, which is then passed to the regular
expression system. So, if you wanted to match the example domain
above, you would enter ^ik\\.ac\\.uk$.
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
6-15