IronPort - advanced configuration guide

Chapter 6 Using Message Filters to Enforce Email Policies
Attachment Groups
OL-25137-01
Table 6-5 Message Filter Actions
Action Syntax Description
Add Footer add-footer(footer-nam
e)
Encrypt on
Delivery
Add a footer to the message. See “Message Disclaimer
Stamping” in the “Text Resources” chapter in the Cisco
IronPort AsyncOS for Email Configuration Guide for
more information.
encrypt-deferred Encrypt message on delivery, which means that the
message continues to the next stage of processing, and
when all processing is complete, the message is encrypted
and delivered.
Add Message Tag tag-message(tag-name) Add a custom term into the message to use with RSA
Email DLP policy filtering. You can configure a RSA
Email DLP policy to limit scanning to messages with the
message tag. The message tag is not visible to recipients.
See Add Message Tag Action, page 6-64 and the “Data
Loss Prevention” chapter in the Cisco IronPort AsyncOS
for Email Configuration Guide.
Add Log Entry log-entry Adds customized text into the IronPort Text Mail logs at
the INFO level. The text can include action variables. The
log entry appears in message tracking. See Add Log Entry
Action, page 6-65.
*Skip Remaining
Message Filters
skip-filters Ensure that this message is not processed by any other
message filters and continues through the email pipeline.
See Skip Remaining Message Filters Action, page 6-50.
*Drop message drop Drop and discard the message. See Drop Action,
page 6-51.
*Bounce message bounce Send the message back to the sender. See Bounce Action,
page 6-51.
*Encrypt and
Deliver Now
* Final Actions
encrypt Use Cisco IronPort Email Encryption to encrypt outgoing
messages. See Encrypt Action, page 6-51.
You can specify a particular file type (“exe” files for example) or common groups of attachments in the
attachment-filetype and drop-attachments-by-filetype rules. AsyncOS divides the attachments
into the groups listed in Table 6-6.
If you create a message filter that uses the != operator to match a message that does not contain an
attachment with a specific file type, the filter will not perform any action on the message if there is at
least one attachment with the file type you want to filter out. For example, the following filter drops any
message with an attachment that is not an .exe file type:
exe_check: if (attachment-filetype != "exe") {
}
drop();
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
6-45