There is a really good Cisco Whitepaper available which was released in October 2014 (you need a valid cisco login or ask you Cisco Partner for this Whitepaper)
Catch More Spam: Fine-Tune Your Email Security Appliance
other useful Whitepapers links for the Ironport ESA:
http://www.cisco.com/c/en/us/products/security/email-security-appliance/white-paper-listing.html
more useful tips for content filters on the Ironport (SPF, DKIM, URL reputation, file types …):
Cisco IronPort E-mail Security Appliance Best Practices : Part 1
Cisco Ironports Technotes
http://www.cisco.com/c/en/us/support/security/email-security-appliance/tsd-products-support-maintain-and-operate-technotes-list.html