If I define multiple content filters for a given outbound mail policy, would system stop looking at filters once a match is found on one of the content filters or should I force that by using a "final" action in my content filters?
I know "first match wins" apply to some other scenarios, but couldn't see a clear explanation to above question in section 6 of Config guide where content filters are defined (and testing with system did not clear that for me either).
An emaill being processed by the content filters or messages filters will continue down the list of content/message filters until it hits the last filter or a 'final' action filter command. If the email being processed needs to exit (by administrative choice), the filter it hits, should have a final action. This only applies to certain conditions, where the administrator does not want the filter's last action to be overwritten by another filter down the pipeline.
Learn about the rapidly evolving cyberthreat landscape and how both organizations and users can protect themselves as we transition to a forever hybrid world through a conversation with Cisco Talos Security Research Leader for Europe, Middle East, Africa,...
When we said the word “hybrid” in the past, it usually recalled the image of a new variety of plant or maybe an electric car. These days, it applies to the workplace too.
The future of work isn’t “changing” to a h...
Thanks for attending our Ask the Experts (ATXs) session! Here’s the post-session resources for easy reference.
New to ATXs? An ATXs session, offered at no cost, is an hour of real-time learning led by Cisco experts, who will answer your technology q...
Cisco Secure Endpoint
New packages fit for every organization
Every Cisco Secure Endpoint (formerly AMP for Endpoints) package comes with Cisco SecureX built-in. It’s our cloud-native platform that integrates all your security solutions into one view wit...