cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Cisco Secure Email Support Community

Product Support Talos Support Cisco Support Reference + Current Release
Gateway Reputation Lookup Open a support case Secure Email Guided Setup
Gateway: 14.0.0-698
Cloud Gateway Email Status Portal Support & Downloads docs.ces.cisco.com
Email and Web Manager: 14.0.0-404
Email and Web Manager Web & Email Reputation Worldwide Contacts Product Naming Quick Reference
Reporting Plug-in: 1.1.0.136
Encryption Bug Search
Encryption Plug-in: 1.2.1.167
Cloud Mailbox Notification Service
Outlook Add-in(s): More info

913
Views
0
Helpful
6
Replies
slicciardola
Beginner

ESA C600V empty subject AND empty body

Hi all,

i must implement the following rule with those content filtering criterias:

* subject:  empty

* body: empty

i've already done some tests.

Subject --> equals (or containts)= ^$

Body --> contains= ^$

if i set the condition on "if one or more is matched" it works, if i set the condition on "only if all conditions match" , and i need the second one, the combination of both.

can someone help me?

Thanks

6 REPLIES 6
Libin Varghese
Cisco Employee

Hi,

Our content search filter conditions (i.e. body-contains, attachement-contains, etc) all search line by line; like grep. We can search for empty lines (^$).... However, most emails have at least one empty line in the body section, so there would be many, many FPs.

I suggest reviewing examples of these 'no body' emails. There may be something else that these emails have in common that can be detected in filters.

Also, just because it looks 'empty' to the human eye, doesn't mean it is truly empty. There many be whitespace, html code, or unprintable characters. So make sure to look deep (i.e. packet capture, archive via Message Filter, or injection debug logs).

Thanks

Libin Varghese

Hi Libin and thanks for the answer.

we looked and we found really blank ones.

So, the reason why the AND conditions is not working is because it cannot work? Is made by default that is not going to work?

Hi,

The content filter conditions would work as expected with the AND OR conditions.

How it works would depend on the email sample you are testing with, I would recommend saving the original email as .eml and then opening it in a text editor to review the actual contents on the email.

- Libin V

hi,

i am testing with my blank email.

if i use the OR condition, it works, if i choose the AND condition it doesn't work,

that's why i am getting really mad!

You can certainly open a TAC case to get the filter reviewed and tested with the email sample.

- Libin V

ok, at this point my only choice is to open a case,

thanks!

Content for Community-Ad