User Guide
9-60
AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Actions
S/MIME Sign or Encrypt on Delivery Action
The smime-gateway-deferred action performs an S/MIME signing or encryption of the message using
the specified sending profile during the delivery. This means that the message continues to the next stage
of processing, and when all processing is complete, the message is signed or encrypted and delivered.
The following filter performs an S/MIME encryption on all the outgoing messages from a particular
sender during the delivery:
smime-deferred:if(mail-from ==
"user@example.com"){smime-gateway-deferred("smime-encrypt");}
S/MIME Sign or Encrypt Action
The smime-gateway action performs an S/MIME signing or encryption using the specified sending
profile and delivers the message, skipping any further processing.
The following filter performs an S/MIME signing on all the outgoing messages from a particular sender
and delivers them immediately:
smime-deliver-now:if(mail-from == "user@example.com"){smime-gateway("smime-sign");}
Notify and Notify-Copy Actions
The notify and notify-copy actions send an email summary of the message to the specified email
address. The
notify-copy action also sends a copy of the original message, similar to the bcc-scan
action. The notification summary contains:
• The contents of the Envelope Sender and Envelope Recipient (MAIL FROM and RCPT TO) directives
from the mail transfer protocol conversation for the message.
• The message headers of the message.
• The name of the message filter that matched the message.
You can specify the recipient, subject line, from address, and notification template. the following filter
selects messages with sizes larger than 4 megabytes, sends a notification email of each matching
message to
admin@example.com, and finally discards the message:
Or
bigFilter:
if(body-size >= 4M)
{
notify('admin@example.com');
drop();
}
bigFilterCopy:
if(body-size >= 4M)