IronPort - advanced configuration guide

BCC and Scan Mail Sent to Competitors
Block Specific User Filter
Archive and Drop Messages Filter
Large “To:” Header Filter
6-98
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
Chapter 6 Using Message Filters to Enforce Email Policies
This filter scans and blind copies messages that are sent to competitors. Note that you could use a
dictionary and the header-dictionary-match() rule to specify a more flexible list of competitors (see
Dictionary Rules, page 6-33):
competitorFilter:
if (rcpt-to == '@competitor1.com|@competitor2.com') {
}
bcc-scan('legal@example.com');
Use this filter to block email from a specific address:
block_harrasing_user:
if (mail-from == "ex-employee@hotmail\\.com") {
}
notify ("admin@company.com");
drop ();
Log and drop only the messages that have matching filetypes:
drop_attachments:
if (mail-from != "user@example.com") AND (attachment-filename ==
'(?i)\\.(asp|bas|bat|cmd|cpl|exe|hta|ins|isp|js)$')
{
archive("Drop_Attachments");
insert-header("X-Filter", "Dropped by: $FilterName MID: $MID");
drop-attachments-by-name("\\.(asp|bas|bat|cmd|cpl|exe|hta|ins|isp|js)$");
}
Find messages with very large “To” headers.
OL-25137-01