User Guide
21-7
AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide
Chapter 21 Text Resources
Using and Testing the Content Dictionaries Filter Rules
In the following example, a new message filter using the dictionary-match() rule is created to blind
carbon copy the administrator when the appliance scans a message that contains any words within the
dictionary named “secret_words” (created in the previous example). Note that because of the settings,
only messages that contain the whole word “
codename” matching the case exactly will evaluate to true
for this filter.
In this example, we send the message to the Policy quarantine:
Related Topics
• Example Dictionary Entries, page 21-7
• Testing Content Dictionaries, page 21-8
Example Dictionary Entries
bcc_codenames:
if (dictionary-match ('secret_words'))
{
bcc('administrator@example.com');
}
quarantine_codenames:
if (dictionary-match ('secret_words'))
{
quarantine('Policy');
}
Table 21-2 Example Dictionary Entries
Description Example
Wildcard
*
Anchors Ends with: foo$
Begins with: ^foo
Email address
(Do not escape the period)
foo@example.com, @example.com
example.com$
(ends with)
@example.*
Subject An email subject
(keep in mind when using the ^ anchor in email subjects that
subjects are often prepended with “RE:” or “FW:” and the like)