IronPort - advanced configuration guide

Chapter 6 Using Message Filters to Enforce Email Policies
Smart Identifiers
Smart Identifier Syntax
OL-25137-01
rendered in a way that makes it difficult for the scanning engine to determine word and line breaks. When
you attempt to match a regular expression against a PDF file constructed in this way, the scanning engine
may return unexpected results.
For example, you enter a word in a PowerPoint document that uses different fonts and different font
sizes for each letter in the word. When a scanning engine reads a PDF generated from this application,
it inserts logical spaces and line breaks. Because of the construction of the PDF, it may interpret the word
“callout” as “call out” or “c a l lout.” Attempting to match either of these renderings against the regular
expression, “callout,” would result in no matches.
When you use message rules that scan message content, you can use smart identifiers to detect certain
patterns in the data.
Smart identifiers can detect the following patterns in data:
Credit card numbers
U.S. Social Security numbers
Committee on Uniform Security Identification Procedures (CUSIP) numbers
American Banking Association (ABA) routing numbers
To use smart identifiers in a filter, enter the following keywords in a filter rule that scans body or
attachment content:
Table 6-4 Smart Identifiers in Message Filters
Key Word Smart Identifier Description
*credit Credit card number Identifies 14-, 15-, and 16- digit credit
card numbers.
*aba ABA routing number
NOTE: The smart identifier does not
identify enRoute or JCB cards.
Identifies ABA routing numbers.
*ssn Social security number Identifies U.S. social security
numbers. The *ssn smart identifier
identifies social security numbers with
dashes, periods and spaces.
*cusip CUSIP number Identifies CUSIP numbers.
When you use a smart identifier in a filter rule, enter the smart-identifier keyword in quotes within a filter
rule that scans the body or attachment file, as in the example below:
ID_Credit_Cards:
if(body-contains("*credit")){
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
6-19