IronPort - advanced configuration guide

Chapter 6 Using Message Filters to Enforce Email Policies
OL-25137-01
considered protected. Similarly, PDF file that has no open password will not be considered protected,
even though it may restrict copying or printing with a password. The following example shows protected
attachments sent to a policy quarantine:
quarantine_protected:
if attachment-protected
{
quarantine("Policy");
}
Detecting Unprotected Attachments
The attachment-unprotected filter tests whether any attachment in the message is not password
protected. This message filter complements the attachment-protected filter. You might use this filter
on outgoing mail to detect outgoing mail that is unprotected. The following example shows AsyncOS
detecting unprotected attachments on an outgoing listener and quarantining the messages:
quarantine_unprotected:
if attachment-unprotected
{
quarantine("Policy");
}
Using the CLI to Manage Message Filters
You can use the CLI to add, delete, activate and de-activate, import and export, and set logging options
for message filters. The table below shows a summary of the commands and subcommands.
Table 6-9 Message Filters Subcommands
Syntax Description
filters The main command. This command is interactive; it asks you for more information
(for example, new, delete, import).
new Creates a new filter. If no location is given, it is appended to the current sequence.
Otherwise, the filter will be inserted into the specific place in the sequence. For more
information, see Creating a New Message Filter, page 6-76.
delete Deletes a filter by name or by sequence number. For more information, see Deleting
a Message Filter, page 6-77.
move Rearranges the existing filters. For more information, see Moving a Message Filter,
page 6-77.
set Sets filter to active or inactive state. For more information, see Activating and
Deactivating a Message Filter, page 6-77.
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
6-75