IronPort - advanced configuration guide

6-20
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
Chapter 6 Using Message Filters to Enforce Email Policies
You can also use smart identifiers in content filters and as a part of content dictionaries.
Note You cannot combine a smart identifier key word with a normal regular expression or another key word.
For example the pattern *credit|*ssn would not be valid.
Note To minimize on false positives using the *SSN smart identifier, it may be helpful to use the *ssn smart
identifier along with other filter criteria. One example filter that can be used is the “only-body-contains”
filter condition. This will only evaluate the expression to be true if the search string is present in all of
the message body mime parts. For example, you could create the following filter:
SSN-nohtml: if only-body-contains(“*ssn”) { duplicate-quarantine(“Policy”);}
Examples of Message Filter Rules
True Rule
Valid Rule
notify("legaldept@example.com");
}
.
The following section shows examples of message filter rules in use.
The true rule matches all messages. For example, the following rule changes the IP interface to external
for all messages it tests.
externalFilter:
if (true)
{
}
alt-src-host('external');
The valid rule returns false if the message contains unparsable/invalid MIME parts and true otherwise.
For example, the following rule drops all unparsable messages it tests.
not-valid-mime:
if not valid
{
OL-25137-01