IronPort - advanced configuration guide

Chapter 6 Using Message Filters to Enforce Email Policies
Alter Recipient Action
Alter Delivery Host Action
OL-25137-01
In the following example, the message is sent to the Policy quarantine if the message contains any words
within the dictionary named “secret_word.”
quarantine_codenames:
if (dictionary-match ('secret_words'))
{
quarantine('Policy');
}
In the following example, suppose a company has an official policy to drop all .mp3 file attachments. If
an inbound message has a .mp3 attachment, the attachment is stripped and the remaining message
(original body and remaining attachments) is sent to the original recipient. Another copy of the original
message with all attachments will be quarantined (sent to the Policy quarantine). If it is necessary to
receive the blocked attachment(s), the original recipient would then request that the message be released
from the quarantine.
strip_all_mp3s:
if (attachment-filename == '(?i)\\.mp3$') {
}
The alt-rcpt-to action changes all recipients of the message to the specified recipient upon delivery.
The following filter sends all messages with an Envelope Recipient address that contain .freelist.com
and changes all recipients for the message to
system-lists@myhost.com:
freelistFilter:
duplicate-quarantine('Policy');
drop-attachments-by-name('(?i)\\.mp3$');
if(rcpt-to == '\\.freelist\\.com$')
{
}
alt-rcpt-to('system-lists@myhost.com');
The alt-mailhost action changes the IP address for all recipients of the selected message to the numeric
IP address or hostname given.
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
6-57