OK. So - looking @Content Disarm & Reconstruction...
The ESA does not directly deconstruct based on this definition... however...
For URLs, we can use URL Filtering. If there are active URL in a body of an email, they can be scanned and acted upon, see the User Guide for full details. URL filtering takes advantage of WBRS scoring in order to rule against websites/domains in the URLs.
We also provide File Reputation and File Analysis. Similar to A/V, AMP will scan a file for SHA pattern and then take action upon analysis of said SHA. If there are malware + attachments, you can set to deliver (which can be moved to an administration quarantine if malware +), or drop.
Similar, for Spam, A/V (Sophos and McAfee), and Virus Outbreak Filters (VOF), you can set these to deliver as-is, quarantine. For A/V, you can modify the message and strip attachments, or "attempt to repair" --- just depends on what level of action and administration you are wishing to take against the policy or sender/recipients of the messages.
It is not the exact same as the CDR definition listed --- but, with the services in play on the ESA, you can still remove unwanted or malicious +, possible malicious information from the emails AS presented for scanning to the ESA.
-Robert
