cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1111
Views
0
Helpful
3
Replies

content filtering after quarantine

Hi,
does anyone know if it's possible to reapply the content filtering to a mail that has been quarantine by one content filter.
For example if I setup 10 content filters and the 2nd one quarantine the message because of a particular content, the administrator check the mail and after accept it, the mail need to pass trough the remaining 8 content filters and not been immediately delivered to the recipients.
Is it possible?
Thank you.

3 Replies 3

Douglas Hardison
Cisco Employee
Cisco Employee

Not without re-injecting the email, which poses the issue that the original filter could trap it again...

The IronPort immediately delivers messages released from the quarantine, they are not subject to further filtering.

Hello!
I would like to help you.... if I truly understood your problem.
If the order of filters isn't important, you can set the Quarantine filter the last one (#10). So your message will pass through all filters and only then it will go to the quarantine.

ironport99
Level 1
Level 1

A quarantine action on a content filter does not immediately deliver the message to the quarantine as it is a non-final action (unless you have included a deliver() action on the filter) it only flags it for quarantine - the message will pass through the rest of the email pipeline (including any other content filters) - assuming that it does not get any other final actions (drop, bounce, deliver) the email will then be quarantined (and it can be quarantined in multiple quarantines depending on results from other filters). When the message is released it will be rescanned for viruses if you have antivirus scanning enabled before it is delivered but not be subject to any other filters.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: