User Guide

11-2
AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide
Chapter 11 Content Filters
How Content Filters Work
Related Topics
• How to Scan Message Content Using a Content Filter, page 11-2
• Content Filter Conditions, page 11-2
• Content Filter Actions, page 11-9
• Action Variables, page 11-14
How to Scan Message Content Using a Content Filter
Content Filter Conditions
A condition is a “trigger” that determines whether the Email Security appliance uses the filter on a
message that matches the associated mail policy. Specifying conditions for a content filter is optional.
Content filters without a condition are applied to all messages that match the associated mail policy.
In the content filter conditions, when you add filter rules that search for certain patterns in the message
body or attachments, you can specify the minimum threshold for the number of times the pattern must
be found. When AsyncOS scans the message, it totals the “score” for the number of matches it finds in
the message and attachments. If the minimum threshold is not met, the regular expression does not
evaluate to true. You can specify this threshold for text, smart identifiers, or content dictionary terms.
Do This More Info
Step 1
(Optional) Define the supporting features for
the content filter.
Create any of the following items that you want to use with
your content filter:
• Encryption Profile
• Disclaimer template
• Notification template
• Policy quarantine
• URL whitelists
Step 2
Define the incoming or outgoing content filter. A content filter may comprise of three parts:
• Content Filter Conditions (optional)
• Content Filter Actions
• Action Variables (optional)
Creating a Content Filter, page 11-16
Step 3
Define the group of users for whom you want
to set up content security rules.
Create an incoming or outgoing mail policy.
Step 4
Assign the content filter to the group of user
whose incoming or outgoing messages you
want to use the filter for.
See Chapter 10, “Mail Policies.”