Introduction
Image Analysis is an extra feature that needs to be licensed in order to be enabled and used on the Cisco Email Security Appliance (ESA).
Some messages contain images that you may wish to scan for inappropriate content. You can use the image analysis engine to search for inappropriate content in email. Image analysis is not designed to supplement or replace your anti-virus and anti-spam scanning engines. Its purpose is to enforce acceptable use by identifying inappropriate content in email. Use the image analysis scanning engine to quarantine and analyze mail and to detect trends.
After you configure AsyncOS for image analysis, you can use image analysis filter rules to perform actions on suspect or inappropriate emails. Image scanning allows you to scan the following types of attached files: JPEG, BMP, PNG, TIFF, GIF, TGA, ICO, and PCX. The image analyzer uses algorithms that measure skin color, body size and curvature to determine the probability that the graphic contains inappropriate content. When you scan image attachments, Cisco fingerprinting determines the file type, and the image analyzer uses algorithms to analyze the image content. If the image is embedded in another file, the Stellent scanning engine extracts the file. The Stellent scanning engine can extract images from many file types, including Word, Excel, and PowerPoint documents. The image analysis verdict is computed on the message as a whole. If the message does not include any images, the message receives a score of ?0? which maps to a ?clean? verdict. Therefore, a message without any images will receive a "clean" verdict.
Note: Images cannot be extracted from PDF files.
View the Verdict Score of a Particular Message
To see the verdict score for a particular message, you can view the mail logs. The mail logs display the image name or file name, the score for a particular message attachment. In addition, the log displays information about whether the images in a file were scannable or unscannable. Note that information in the log describes the result for each message attachment, rather than each image. For example, if the message had a zip attachment that contained a JPEG image, the log entry would contain the name of the zip file rather than the name of the JPEG. Also, if the zip file included multiple images then the log entry would include the maximum score of all the images. The unscannable notation indicates whether any of the images were unscannable.
The log does not contain information about how the scores translate to a particular verdict (clean, suspect or inappropriate). However, because you can use mail logs to track the delivery of specific messages, you can determine by the actions performed on the messages whether the mail contained inappropriate or suspect images.
For example, the following mail log shows attachments dropped by message filter rules as a result of Image Analysis scanning:
Thu Apr 3 08:17:56 2009 Debug: MID 154 IronPort Image Analysis: image 'Unscannable.jpg'
is unscannable.
Thu Apr 3 08:17:56 2009 Info: MID 154 IronPort Image Analysis: attachment
'Unscannable.jpg' score 0 unscannable
Thu Apr 3 08:17:56 2009 Info: MID 6 rewritten to MID 7 by
drop-attachments-where-image-verdict filter 'f-001'
Thu Apr 3 08:17:56 2009 Info: Message finished MID 6 done
Related Information
Feedback