IronPort - advanced configuration guide

Chapter 6 Using Message Filters to Enforce Email Policies
Dictionary Rules
OL-25137-01
Values for the SenderBase Reputation rule are -10 through 10, but the value NONE may also be returned.
To check specifically for the value NONE, use the no-reputation rule.
none_rep:
if (no-reputation) {
}
strip-header ('Subject');
The dictionary-match() rule evaluates to true if the message body contains any of
the regular expressions or terms in the content dictionary named “dictonary_name.” If the dictionary
does not exist, the rule evaluates to false. For more information on defining dictionaries (including their
case sensitivity and word boundary settings), see the “Text Resources” chapter in the Cisco IronPort
AsyncOS for Email Configuration Guide.
The following filter blind carbon copies the administrator when the Cisco IronPort scans a message that
contains any words within the dictionary named “secret_words.”
copy_codenames:
insert-header ('Subject', '*** Reputation = NONE *** $Subject');
if (dictionary-match ('secret_words')) {
bcc('administrator@example.com');
}
The following example sends the message to the Policy quarantine if the message body contains any
words within the dictionary named “secret_words.” Unlike the only-body-contains condition, the
body-dictionary-match condition does not require that all the content parts individually match the
dictionary. The scores of each content part (taking into account multipart/alternative parts) are added
together.
quarantine_data_loss_prevention:
if (body-dictionary-match ('secret_words'))
{
quarantine('Policy');
}
In the following filter, a subject that matches a term in the specified dictionary is quarantined:
quarantine_policy_subject:
if (subject-dictionary-match ('gTest'))
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
6-33