IronPort - advanced configuration guide

Message Filters for Scanning Attachments
6-66
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
Chapter 6 Using Message Filters to Enforce Email Policies
The message filter actions described in Table 6-8 are non-final actions. (Attachments are dropped and
the message processing continues.)
The optional comment is text that is added to the message, much like a footer, and it can contain Message
Filter Action Variables (see Examples of Attachment Scanning Message Filters, page 6-72).
Table 6-8 Message Filter Actions for Attachment Filtering
Action Syntax Description
Drop Attachments
by Name
Drop Attachments
by Type
Drop Attachments
by File Type
Drop Attachments
by MIME Type
Drop Attachments
by Size
Attachment
Scanning
Drop Attachments
by Dictionary
Matches
drop-attachments-by-name
([,
])
drop-attachments-by-type
([, ])
drop-attachments-by-filetype
([,
])
drop-attachments-by-mimetype
([, ])
drop-attachments-by-size
([, ])
drop-attachments-where-contai
ns ([,
])
drop-attachments-where-dictio
nary-match()
Drops all attachments on messages that have a
filename that matches the given regular
expression. Archive file attachments (zip, tar)
will be dropped if they contain a file that
matches. See Examples of Attachment
Scanning Message Filters, page 6-72.
Drops all attachments on messages that have a
MIME type, determined by either the given
MIME type or the file extension. Archive file
attachments (zip, tar) will be dropped if they
contain a file that matches.
Drops all attachments on messages that match
the given “fingerprint” of the file. Archive file
attachments (zip, tar) will be dropped if they
contain a file that matches. For more
information, see Table 6-6Attachment Groups,
page 6-46.
Drops all attachments on messages that have a
given MIME type. This action does not attempt
to ascertain the MIME type by file extension
and so it also does not examine the contents of
archives.
Drops all attachments on the message that, in
raw encoded form, are equal to or greater than
the size (in bytes) given. Note that for archive
or compressed files, this action does not
examine the uncompressed size, but rather the
size of the actual attachment itself.
Drops all attachments on message that contain
the regular expression. Archive files (zip, tar)
will be dropped if any of the files they contain
match the regular expression pattern.
This filter action strips attachments based on
matches to dictionary terms. If the terms in the
MIME parts considered to be an attachment
match a dictionary term (and the user-defined
threshold is met), the attachment is stripped
from the email. See Examples of Attachment
Scanning Message Filters, page 6-72.
OL-25137-01