User Guide

9-12
AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Rules
S/MIME Gateway
Verified
smime-gateway-verified
Is the S/MIME message successfully verified,
decrypted, or decrypted and verified? See
S/MIME Gateway Verified Rule, page 9-40
Image verdict
image-verdict
What was the image scanning verdict? This filter
rule allows you to query for different image
analysis verdicts. See Image Analysis,
page 9-77.
Workqueue count
workqueue-count
Is the work queue count equal to, less than, or
greater than the specified value? See
Workqueue-count Rule, page 9-40.
Body Scanning
body-contains(<regular
expression>)
Does the message contain text or an attachment
that matches a specified pattern? Does the
pattern occur the minimum number of times you
specified for the threshold value?
The engine scans delivery-status parts and
associated attachments.
See Body Scanning Rule, page 9-31.
Body Scanning
only-body-contains(<regular
expression>)
Does the message body contain text that matches
a specified pattern? Does the pattern occur the
minimum number of times you specified for the
threshold value? Attachments are not scanned.
See Body Scanning, page 9-31.
Encryption
Detection
encrypted
Is the message encrypted? See Encryption
Detection Rule, page 9-32.
Attachment
Filename
a
attachment-filename
Does the message contain an attachment with a
filename that matches a specific pattern? See
Attachment Filename Rule, page 9-33.
Attachment Type
a
attachment-type
Does the message contain an attachment of a
particular MIME type? See Attachment Type
Rule, page 9-32.
Table 9-2 Message Filter Rules
Rule Syntax Description