Message filter basics

[Christopher Smith]

This video covers the basics of creating a message filter using the CLI as well as the basic syntax of message filters.

00:00 - 01:00 Introduction, message filter basics

01:00 - 01:11 Filter example syntax

01:12 - 02:20 Mesage filter menu options

02:21 - 06:11 Creating a mesage filter

06:12 - 06:52 Help and epilog

[Christopher Smith]

In this video I state in error that message filters come after policy processing which is incorrect, message filters come Before policy processing.  My apologies for the confusion. I will be correcting the video shortly.

[elias.winburne]

Great introduction to those of us who are new to this product!

[Bob Bagheri]

Why is MF only available via CLI?

[Christopher Smith]

Hi Bob,

Excellent question. Both message filters and content filters are based on regex. If you ever look at a content filter in the CLI you will see that the syntax is very similar is not the same. The content filters section of the GUI is a lot like an API with a list of preset building blocks. These building blocks consist of conditions and actions that were carefully selected to try and cover most needs. While it is technically possible to include most of the message filter functionality in content filters this would likely make the content filters section of the GUI very complex and difficult to use. If you have an recommendations of message filter functionality you would like to see in content filters please let us know and we will be happy to create a feature request!

Christopher C Smith

CSE

Cisco IronPort Customer Support

[Bechara.abouraha]

How can we apply the rule in the incoming and outgoing?

i want to apply a policy that checked if the incoming and outgoing emails are encypted, therefore qurantine,

please advise,

Best Regards,

[Tze Tai Mak]

Hi,

You can add a message filter (per message CLI 'filters' command,  take action before per recipient policy - antispam/antivirus/content  filter/outbreak filter) or GUI based content filter.

For message filter, there are message filter conditions like  'encrypted' and 'attachment-protected'. You can write a message filter  like below:-

quarantine_protected:
                    if attachment-protected
                    {
                    quarantine("Policy");
                    }
 

The message filter will quarantine the message in 'Policy' quarantine (only administrator or predefined user role can access).

Please  note that you can add an icoming content filter and outgoing content  filter using attachment-protected condition from GUI interface, and  enable it based on incoming and/or outgoing mail policy.

Tommy

[Bechara.abouraha]

How can I apply this policy ?

[Tze Tai Mak]

1. Create the incoming content filter

2. Create new incoming mail policy for sender/recipient or click on content filter column in existing mail policy or default mail policy

3. click and select the checkbox(es) of incoming content filters.

Note: You can create a new incoming mail policy for your own email recipient address, test the content filter before applying for others.

The same applies for outgoing mail policy.