IronPort - advanced configuration guide

6-52
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
Chapter 6 Using Message Filters to Enforce Email Policies
Note You must have a Cisco IronPort Encryption Appliance in your network or a hosted key service
configured to use this filter action. You must also have configured an encryption profile to use this filter
action.
Notify and Notify-Copy Actions
The notify and notify-copy actions send an email summary of the message to the specified email
address. The notify-copy action also sends a copy of the original message, similar to the bcc-scan
action. The notification summary contains:
The contents of the Envelope Sender and Envelope Recipient (MAIL FROM and RCPT TO) directives
from the mail transfer protocol conversation for the message.
The message headers of the message.
The name of the message filter that matched the message.
You can specify the recipient, subject line, from address, and notification template. the following filter
selects messages with sizes larger than 4 megabytes, sends a notification email of each matching
message to admin@example.com, and finally discards the message:
Or
{
}
bigFilter:
encrypt('My_Encryption_Profile');
if(body-size >= 4M)
{
}
notify('admin@example.com');
drop();
bigFilterCopy:
if(body-size >= 4M)
{
}
notify-copy('admin@example.com');
drop();
OL-25137-01