Cisco Ironport Filter Scripting

[linus.laeubli]

Hello everyone,

I recently looked into Anti-Spoofing with a Custom Filter Script.

if ( (sendergroup != "relaylist") )
{
if ((header-dictionary-match("anti-spoof","From", 1)) OR (mail-from-dictionary-match("anti-spoof", 1)))
{
quarantine ('Policy');
}
}
.

This script works like a charm.

However it left me wondering, how could I extend or make my own scripts.

No amount of googling has given me any kind of good reference guide to the syntax used.

Does anyone here have some pointers maybe?

Cheers!

Linus

[Robert Sherwin · Accepted solution]

The User Guide will contain most all the information you are looking for:

see ---> Using Message Filters to Enforce Email Policies

Other articles of interest:

How do I write more efficient message filters?

ESA Message Filter Action Descriptions

There are many examples of message and content filters in our TechNotes, but - you'll need to have an issue in mind and search specifically for that...

I hope this helps!

-Robert

(*If you have received the answer to your original question, and found this helpful/correct - please mark the question as answered, and be sure to leave a rating to reflect!)