Guest

Cisco Email Security Appliance

Message Content that Matches the Word on a Content Filter

Hierarchical Navigation

Introduction

This document describes how to find the word in a quarantined message that matches the word on a content filter.

Prerequiste

Cisco recommends that you have knowledge of these topics:

  •  ESA AsyncOS version 5.5 and later

Configure

From the GUI:

  1. Go to Monitor > Quarantines
  2. Click Policy
  3. Use these search fields to find the message:
  • Search In: Policy
  • For Messages Received: Choose the day, time, or period
  • Envelope Sender: From address
  • Envelope Receipient(s): Recipient address
  • Subject: Subject of the message

Note: You could do the search based on one or more of these messages.

  1. Click on the Subject of the message.
  2. Look for these in the message details quarantine page:
  • Attachment Name: Determines if the content was matched in an attachment or a message body.
  • Matched Content: Displays the "WORD" or "Number" (ABA or SSN or CCN) message was matched by the filter.
  • Condition: Explains the filter condition.

Note: All matched content is highlighted in yellow.