IronPort - advanced configuration guide

Notification Template
6-54
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
Chapter 6 Using Message Filters to Enforce Email Policies
You can also use the $MatchedContent action variable to notify senders or administrators that a content
filter was triggered. The $MatchedContent action variable displays the content that triggered the filter.
For example, the following filter sends a notification to an administrator if the email contains ABA
account information.
ABA_filter:
Blind Carbon Copy Actions
if (body-contains ('*aba')){
notify('admin@example.com','[$MatchedContent]Account Information Displayed');
}
You can use the Text Resources page or the textconfig CLI command to configure custom notification
templates as text resources for use with the notify() and notify-copy() actions. If you do not create a
custom notification template, a default template is used. The default template includes message headers,
but the custom notification template does not include message headers by default. To include message
headers in the custom notification, include the $AllHeaders action variable.
For more information, see the “Text Resources” chapter in the Cisco IronPort AsyncOS for Email
Configuration Guide.
in the following example, when a large message triggers the filter shown below, an email is sent to the
intended recipients explaining that the message was too large:
bigFilter:
if (body-size >= 4M)
{
}
notify('$EnvelopeRecipients', '[$FilterName] Message too large',
drop();
'$EnvelopeFrom', 'message.too.large');
The bcc action sends an anonymous copy of the message to a specified recipient. This is sometimes
referred to as message replication. Because no mention of the copy is made in the original message and
the anonymous copy will never successfully bounce back to the recipient, the original sender and
recipients of the message will not necessarily know that the copy was sent.
the following filter sends a blind carbon copy to mom@home.org for each message addressed to sue from
johnny:
momFilter:
if ((mail-from == '^johnny$') and (rcpt-to == '^sue$'))
OL-25137-01