User Guide

9-10
AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Rules
Message Filter Rules
Each message filter contains a rule that defines the collection of messages that a filter can act upon. You
define the filter rules, and then you define a filter action for messages that return
true.
Related Topics
• Filter Rules Summary Table, page 9-10
• Regular Expressions in Rules, page 9-16
• Smart Identifiers, page 9-20
• Description and Examples of Message Filter Actions, page 9-57
Filter Rules Summary Table
Table 9-2 summarizes the rules you can use in message filters.
Table 9-2 Message Filter Rules
Rule Syntax Description
Subject Header
subject
Does the subject header match a certain pattern?
See Subject Rule, page 9-23.
Body Size
body-size
Is the body size within some range? See Body
Size Rule, page 9-26.
Envelope Sender
mail-from
Does the Envelope Sender (i.e., the Envelope
From, <MAIL FROM>) match a given pattern?
See Envelope Sender Rule, page 9-25.
Envelope Sender in
Group
mail-from-group
Is the Envelope Sender (i.e., the Envelope From,
<MAIL FROM>) in a given LDAP group? See
Envelope Sender in Group Rule, page 9-25.
Sender Group
sendergroup
Which sender group was matched in a listener's
Host Access Table (HAT)? See Sender Group
Rule, page 9-26.
Envelope Recipient
rcpt-to
Does the Envelope Recipient, (i.e. the Envelope
To, <RCPT TO>) match a given pattern? See
Envelope Recipient Rule, page 9-24.
Note: The
rcpt-to rule is message-based. If a
message has multiple recipients, only one
recipient has to match the rule for the specified
action to affect the message to all recipients.