IronPort - advanced configuration guide

6-34
{
quarantine('Policy');
}
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
Chapter 6 Using Message Filters to Enforce Email Policies
This example matches an email address in the “to” header and blind copies an administrator:
headerTest:
if (header-dictionary-match ('competitorsList', 'to'))
{
bcc('administrator@example.com');
}
The attachment-dictionary-match() rule works like the dictionary-match rule
above, except that it looks for matches in the attachment.
The following filter sends the message to the Policy quarantine if the message attachment contains any
words found within the dictionary named “secret_words.”
quarantine_codenames_attachment:
if (attachment-dictionary-match ('secret_words'))
{
quarantine('Policy');
}
The header-dictionary-match(, ) rule works like the dictionary-match
rule above, except that it looks for matches in the header specified in . The header name is case
insensitive, so, for example, “subject” and “Subject” both work.
The following filter sends the message to the Policy quarantine if the message’s “cc” header contains
any words found within the dictionary named “ex_employees.”
quarantine_codenames_attachment:
if (header-dictionary-match ('ex_employees', 'cc'))
{
quarantine('Policy');
}
You can use wild cards within the dictionary terms. You do not have to escape the period in email
addresses.
OL-25137-01