Writing Message Filters Script via CLI

[Anshul Sinha]

Is there any document to refer while writing scripts for message filters?

My ESA is on version 8.0.1 and I am unable to make text "case insensitive" while checking that text under "contains" rule? Is there any mechanism to look for text by ignoring the case?

[Robert Sherwin]

using (?i) in either message or content filter will allow case insensitivity to be used.

Ex.

subject == "(?i)\\[SEND SECURE\\]” 

* Q: What does (?i) do?  Case insensitivity.  Allows for “[SEND SECURE]”, “[send secure]”, “[SeNd SeCuRe]”, etc.

http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118013-config-cdc-00.html

See either the Email Security End User Guide, or the older Advanced Configuration Guide - and look for the "Using Message Filters to Enforce Email Policies" section for full information and examples!

http://www.cisco.com/c/en/us/support/security/email-security-appliance/products-user-guide-list.html

I hope this helps!

-Robert

(*If you have received the answer to your original question, and found this helpful/correct - please mark the question as answered, and be sure to leave a rating to reflect!)

[Anshul Sinha]

Hi Robert,

Thanks for your help. However, while I select "contains" as parameter check rule instead of "begins" or "ends", the case insensitivity (?i) doesn't work. Is there any limitation for "contains" parameter rule check?

[Robert Sherwin]

Can you provide me what your filter is?  Screenshot, or CLI output?

[Anshul Sinha]

Robert,

Here is the script

Blacklist_Sender_MF: if (recv-listener == "ExternalMail") AND (mail-from == "(?i)anshulsinha21@gmail.com") {
                          drop();
}