You need top do this in the policy configuration (policyconfig --> Incoming or Outgoing--> filters) or you can do it in the GUI (Mail Policies --> Incoming/Outgoing Content Filters) since the X-IronPort-AV doesn't get added until the virus checker r...