User Guide

9-33

AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide

Chapter 9 Using Message Filters to Enforce Email Policies

Message Filter Rules

Attachment Filename Rule

The attachment-filename rule checks the filenames of each attachment in a message to see if it matches

the given regular expression. This comparison is case-sensitive. The comparison is, however sensitive to

whitespace so if the filename has encoded whitespace at the end, the filter will skip the attachment. If

one of the message’s attachments matches the filename, this rule returns “true.”

Please note the following points:

• Each attachment’s filename is captured from the MIME headers. The filename in the MIME header

may contain trailing spaces.

• If an attachment is an archive, the Cisco appliance will harvest the filenames from inside the archive,

and apply scan configuration rules (see Configuring Scan Behavior, page 9-112) accordingly.

–

If the attachment is a single compressed file (despite the file extension), it is not considered an

archive and the filename of the compressed file is not harvested. This means that the file is not

processed by the

attachment-filename rule. An example of this type of file is an executable

file (.exe) compressed with

gzip.

–

For attachments consisting of a single compressed file, such as foo.exe.gz, use regular

expression to search for specific file types within compressed files. See Attachment Filenames

and Single Compressed Files within Archive Files, page 9-33.

See Attachment Scanning, page 9-75 for more information on message filter rules you can use to

manipulate attachments to messages.

The following filter checks all email sent through the listener, and if a message contains an attachment

with a filename

*.mp3, the message is bounced: