IronPort - advanced configuration guide

Header Rule
6-26
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
Chapter 6 Using Message Filters to Enforce Email Policies
in US format. (Note that there may be an issue if you are searching messages with non-US date formats.)
the following filter bounces all messages from campaign1@yourdomain.com that are injected after
1:00pm on July 28th, 2003:
TimeOutFilter:
if ((date > '07/28/2003 13:00:00') and (mail-from ==
{
}
'campaign1@yourdomain\\.com'))
bounce();
Note Do not confuse the date rule with the $Date message filter action variable.
The header() rule checks the message headers for a specific header, which must be specified quoted in
parentheses (“header name”). This rule may be compared to a regular expression, much like the subject
rule, or may be used without any comparison, in which case it will be “true” if the header is found in the
message, and “false” if it is not found. For example, the following example checks to see if the header
X-Sample is found, and if its value contains the string “sample text”. If a match is made, the message
is bounced.
FooHeaderFilter:
if (header('X-Sample') == 'sample text')
{
}
bounce();
You can specify non-ASCII characters to search for in the value of the header.
The following example demonstrates the header rule without a comparison. In this case, if the header
X-DeleteMe is found, it is removed from the message.
DeleteMeHeaderFilter:
if header('X-DeleteMe')
{
OL-25137-01