User Guide

9-13
AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Rules
Attachment File
a
Type
attachment-filetype
Does the message contain an attachment of a file
type that matches a specific pattern based on its
fingerprint (similar to a UNIX
file command)?
If the attachment is an Excel or Word document,
you can also search for the following embedded
file types: .exe , .dll, .bmp, .tiff, .pcx, .gif, .jpeg,
png, and Photoshop images.
You must enclose the file type in quotes to create
a valid filter. You can use single or double
quotes. For example, to search for .exe
attachments, use the following syntax:
if (attachment-filetype == "exe")
For more information, see Examples of
Attachment Scanning Message Filters,
page 9-83.
Attachment MIME
Type
a
attachment-mimetype
Does the message contain an attachment of a
specific MIME type? This rule is similar to the
attachment-type rule, except only the MIME
type given by the MIME attachment is evaluated.
(The appliance does not try to “guess” the type
of the file by its extension if there is no explicit
type given.) See Examples of Attachment
Scanning Message Filters, page 9-83.
Attachment
Protected
attachment-protected
Does the message contain an attachment that is
password protected? See Quarantining Protected
Attachments, page 9-86.
Attachment
Unprotected
attachment-unprotected
The attachment-unprotected filter condition
returns true if the scanning engine detects an
attachment that is unprotected. A file is
considered unprotected if the scanning engine
was able to read the attachment. A zip file is
considered to be unprotected if any of its
members is unprotected.
Note — The attachment-unprotected filter
condition is not mutually exclusive of the
attachment-protected filter condition. It is
possible for both filter conditions to return true
when scanning the same attachment. This can
occur, for example, if a zip file contains both
protected and unprotected members.
See Detecting Unprotected Attachments,
page 9-86.
Table 9-2 Message Filter Rules
Rule Syntax Description