User Guide

9-15
AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Rules
Dictionary
b
dictionary-match(<dictionary
_name>)
Does the message body contain any of the
regular expressions or terms in the content
dictionary named dictionary_name? Does the
pattern occur the minimum number of times you
specified for the threshold value? See Dictionary
Rules, page 9-35.
Attachment
Dictionary Match
attachment-dictionary-match(
<dictionary_name>)
Does the attachment contain any of the regular
expressions in the content dictionary named
dictionary_name? Does the pattern occur the
minimum number of times you specified for the
threshold value? See Dictionary Rules,
page 9-35.
Subject Dictionary
Match
subject-dictionary-match(<di
ctionary_name>)
Does the Subject header contain any of the
regular expressions or terms in the content
dictionary named dictionary name? See
Dictionary Rules, page 9-35.
Header Dictionary
Match
header-dictionary-match(<dic
tionary_name>, <header>)
Does the specified header (case insensitive)
contain any of the regular expressions or terms in
the content dictionary named dictionary name?
See Dictionary Rules, page 9-35.
Body Dictionary
Match
body-dictionary-match(<dicti
onary_name>)
This filter condition returns true if the dictionary
term matches content in the body of the message
only. The filter searches for terms within the
MIME parts not considered to be an attachment.
and it returns true if the user-defined threshold is
met (the default threshold value is one). See
Dictionary Rules, page 9-35.
Envelope Recipient
Dictionary Match
rcpt-to-dictionary-match(<di
ctionary_name>)
Does the envelope recipient contain any of the
regular expressions or terms in the content
dictionary named dictionary name? See
Dictionary Rules, page 9-35.
Envelope Sender
Dictionary Match
mail-from-dictionary-match(<
dictionary_name>)
Does the envelope sender contain any of the
regular expressions or terms in the content
dictionary named dictionary name? See
Dictionary Rules, page 9-35.
SMTP
Authenticated User
Match
smtp-auth-id-matches(<target
> [, <sieve-char>])
Does the address of the Envelope Sender and the
address in message header match the
authenticated SMTP user ID of the sender? See
SMTP Authenticated User Match Rule,
page 9-40.
True
true
Matches all messages. See True Rule, page 9-23.
Valid
valid
Returns false if the message contains
unparsable/invalid MIME parts and true
otherwise. See Valid Rule, page 9-23.
Signed
signed
Is the message is signed? See Signed Rule,
page 9-42.
Table 9-2 Message Filter Rules
Rule Syntax Description