What is the CLI command to create a new Message Filter in a Cisco Email Security Appliance?

Enter the filters > new CLI command, as shown in the next example, and implement the only-body-contains rule along with any rules that are appropriate to your environment. This example includes rules for the receiving listener and the mail-from command:
C370.lab (SERVICE)> filters

Choose the operation you want to perform:
– NEW – Create a new filter.
– DELETE – Remove a filter.
– IMPORT – Import a filter script from a file.
– EXPORT – Export filters to a file
– MOVE – Move a filter to a different position.
– SET – Set a filter attribute.
– LIST – List the filters.
– DETAIL – Get detailed information on the filters.
– LOGCONFIG – Configure log subscriptions used by filters.
– ROLLOVERNOW – Roll over a filter log file.

http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/119005-technote-esa-00.html