This video covers the basics of creating a message filter using the CLI as well as the basic syntax of message filters.
00:00 - 01:00 Introduction, message filter basics
01:00 - 01:11 Filter example syntax
01:12 - 02:20 Mesage filter menu options
02:21 - 06:11 Creating a mesage filter
06:12 - 06:52 Help and epilog
In this video I state in error that message filters come after policy processing which is incorrect, message filters come Before policy processing. My apologies for the confusion. I will be correcting the video shortly.
Great introduction to those of us who are new to this product!
Why is MF only available via CLI?
Excellent question. Both message filters and content filters are based on regex. If you ever look at a content filter in the CLI you will see that the syntax is very similar is not the same. The content filters section of the GUI is a lot like an API with a list of preset building blocks. These building blocks consist of conditions and actions that were carefully selected to try and cover most needs. While it is technically possible to include most of the message filter functionality in content filters this would likely make the content filters section of the GUI very complex and difficult to use. If you have an recommendations of message filter functionality you would like to see in content filters please let us know and we will be happy to create a feature request!
Christopher C Smith
Cisco IronPort Customer Support
How can we apply the rule in the incoming and outgoing?
i want to apply a policy that checked if the incoming and outgoing emails are encypted, therefore qurantine,
You can add a message filter (per message CLI 'filters' command, take action before per recipient policy - antispam/antivirus/content filter/outbreak filter) or GUI based content filter.
For message filter, there are message filter conditions like 'encrypted' and 'attachment-protected'. You can write a message filter like below:-
The message filter will quarantine the message in 'Policy' quarantine (only administrator or predefined user role can access).
Please note that you can add an icoming content filter and outgoing content filter using attachment-protected condition from GUI interface, and enable it based on incoming and/or outgoing mail policy.
How can I apply this policy ?
1. Create the incoming content filter
2. Create new incoming mail policy for sender/recipient or click on content filter column in existing mail policy or default mail policy
3. click and select the checkbox(es) of incoming content filters.
Note: You can create a new incoming mail policy for your own email recipient address, test the content filter before applying for others.
The same applies for outgoing mail policy.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.