IronPort - advanced configuration guide

Chapter 6 Using Message Filters to Enforce Email Policies
Image Analysis
OL-25137-01
Some messages contain images that you may wish to scan for inappropriate content. You can use the
image analysis engine to search for inappropriate content in email. Image analysis is not designed to
supplement or replace your anti-virus and anti-spam scanning engines. Its purpose is to enforce
acceptable use by identifying inappropriate content in email. Use the image analysis scanning engine to
quarantine and analyze mail and to detect trends.
After you configure AsyncOS for image analysis, you can use image analysis filter rules to perform
actions on suspect or inappropriate emails. Image scanning allows you to scan the following types of
attached files: JPEG, BMP, PNG, TIFF, GIF, TGA, ICO, and PCX. The image analyzer uses algorithms
that measure skin color, body size and curvature to determine the probability that the graphic contains
inappropriate content. When you scan image attachments, Cisco IronPort fingerprinting determines the
file type, and the image analyzer uses algorithms to analyze the image content. If the image is embedded
in another file, the Stellent scanning engine extracts the file. The Stellent scanning engine can extract
images from many file types, including Word, Excel, and PowerPoint documents. The image analysis
verdict is computed on the message as a whole. If the message does not include any images, the message
receives a score of “0” which maps to a “clean” verdict. Therefore, a message without any images will
receive a "clean" verdict.
Note Images cannot be extracted from PDF files.
To enable image analysis from the GUI:
Step 1 Go to Security Services > IronPort Image Analysis.
Step 2 Click Enable.
A success message displays, and the verdict settings display.
Figure 6-3 Cisco IronPort Image Analysis Overview
The image analysis filter rule allows you to determine the actions to take based on the following verdicts:
Clean: The image is free of inappropriate content. The image analysis verdict is computed on the
message as a whole, so a message without any images will receive a "clean" verdict if scanned.
Suspect: The image may contain inappropriate content.
Inappropriate: The image contains inappropriate content.
These verdicts represent a numeric value assigned by the image analyzer algorithm to determine
probability of inappropriate content.
The following values are recommended:
Clean: 0 to 49
Suspect: 50 to 74
Inappropriate: 75 to 100
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
6-67