Yep, did that. Also did it another way - setup a filter for SSN scanning, and used the notify feature. I then sent a signed message, with a fake SSN. It quarantined and notified based on the SSN. I then looked at the notify message (which includes the evaluated headers).
(that was easier than using Outlooks poor interface to read headers) On Thu, Nov 12, 2009 at 12:06 PM, Don Ely <don....@gmail.com> wrote: > Yeah, that would imply it's working... Have you looked in the message > tracking to see what values are seen in the header to verify you're > filtering the right one? > > On Thu, Nov 12, 2009 at 8:57 AM, Kevin Lundy <klu...@gmail.com> wrote: > >> Not sure what you mean (only had the device about 18 hours). But, I can >> modify the filter to filter something else (e.g. a key word rather than a >> header), and the filter works. So I assume that means it is attached? >> >> >> On Thu, Nov 12, 2009 at 11:53 AM, Don Ely <don....@gmail.com> wrote: >> >>> Did you attach the filter to the SMTP listener? >>> >>> >>> On Thu, Nov 12, 2009 at 8:49 AM, Kevin Lundy <klu...@gmail.com> wrote: >>> >>>> Just got a couple of Ironports. I'm trying to write an outgoing content >>>> filter to identify digitally signed messages. I've tried "Other Header" >>>> with header name of Content-Type and value contains multipart/signed, or >>>> value contains x-pkcs7-signature. >>>> >>>> Can't seem to make it work. Anyone got an idea? >>>> >>>> Thanks >>>> Kevin >>>> >>> >>> >> >
