content filtering after quarantine

Unanswered Question
Oct 29th, 2008
User Badges:

does anyone know if it's possible to reapply the content filtering to a mail that has been quarantine by one content filter.
For example if I setup 10 content filters and the 2nd one quarantine the message because of a particular content, the administrator check the mail and after accept it, the mail need to pass trough the remaining 8 content filters and not been immediately delivered to the recipients.
Is it possible?
Thank you.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Douglas Hardison Wed, 10/29/2008 - 14:19
User Badges:
  • Cisco Employee,

Not without re-injecting the email, which poses the issue that the original filter could trap it again...

The IronPort immediately delivers messages released from the quarantine, they are not subject to further filtering.

OlgaSha_ironport Wed, 10/29/2008 - 15:13
User Badges:

I would like to help you.... if I truly understood your problem.
If the order of filters isn't important, you can set the Quarantine filter the last one (#10). So your message will pass through all filters and only then it will go to the quarantine.

ironport99 Wed, 10/29/2008 - 16:42
User Badges:

A quarantine action on a content filter does not immediately deliver the message to the quarantine as it is a non-final action (unless you have included a deliver() action on the filter) it only flags it for quarantine - the message will pass through the rest of the email pipeline (including any other content filters) - assuming that it does not get any other final actions (drop, bounce, deliver) the email will then be quarantined (and it can be quarantined in multiple quarantines depending on results from other filters). When the message is released it will be rescanned for viruses if you have antivirus scanning enabled before it is delivered but not be subject to any other filters.


This Discussion