Quarantine messages with content filter

[matt.hayden]

Hi all,

Still new to Ironport and I'm trying to figure out a way to create a content filter that will put messages in the user's quarantine box when a cetain word is found in a message body. I can create it just fine in the GUI but the only quarantine that is available to send it to is the "Policy" one. Anyway to send it to the local Ironport Quarantine instead? If a message gets sent to the policy quarantine would the end user get two email notifications if mail was in both of the quarantines?

Using AsyncOS 6.0.0-746
Thanks

[jaigill]

1. Create a content filter with the appropriate conditions.
2. For the Action, Add header with Header name 'X-Ironport-Quarantine' and header value can be anything like 'Quarantine'
After adding the action you should see something similar to this: insert-header("X-Ironport-Quarantine", "Quarantine")
3. Goto 'System Administration -> Log Subscription' and click 'Edit Settings'. Add "X-Ironport-Quarantine" to the Headers section.

This will send the message to the Ironport spam quarantine. Notifications are not sent out when messages are quarantined to the policy quarantine.

[matt.hayden]

Awesome! That did the trick. Thanks!