User Guide

9-14
AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Rules
Attachment
Scanning
a
attachment-contains(<regular
expression>)
Does the message contain an attachment that
contains text or another attachment that matches
a specific pattern? Does the pattern occur the
minimum number of times you specified for the
threshold value?
This rule is similar to the
body-contains() rule,
but it attempts to avoid scanning the entire
“body” of the message. That is, it attempts to
scan only that which the user would view as
being an attachment. See Examples of
Attachment Scanning Message Filters,
page 9-83.
Attachment
Scanning
attachment-binary-contains(<
regular expression>)
Does the message contain an attachment with
binary data that matches a specific pattern?
This rule is like the
attachment-contains ()
rule, but it searches specifically for patterns in
the binary data.
Attachment
Scanning
every-attachment-contains(<r
egular expression>)
Do all of the attachments in this message contain
text that matches a specific pattern? The text
must exist in all attachments and the action
performed is, in effect, a logical AND operation
of an '
attachment-contains()' for each
attachment. The body is not scanned. Does the
pattern occur the minimum number of times you
specified for the threshold value?
See Examples of Attachment Scanning Message
Filters, page 9-83.
Attachment Size
a
attachment-size
Does the message contain an attachment whose
size is within some range? This rule is similar to
the
body-size rule, but it attempts to avoid
scanning the entire “body” of the message. That
is, it attempts to scan only that which the user
would view as being an attachment. The size is
evaluated prior to any decoding. See Examples
of Attachment Scanning Message Filters,
page 9-83.
Public Blacklists
dnslist(<query server>)
Does the sender’s IP address appear on a public
blacklist server (RBL)? See DNS List Rule,
page 9-34.
SenderBase
Reputation
reputation
What is the sender’s SenderBase Reputation
Score? See SenderBase Reputation Rule,
page 9-34.
No SenderBase
Reputation
no-reputation
Used to test if SenderBase Reputation Score is
“None.” See SenderBase Reputation Rule,
page 9-34.
Table 9-2 Message Filter Rules
Rule Syntax Description