Creating a Content Filtering expression

A Content Filtering expression consists of conditions that contain message attributes and their values. Conditions are combined by logical connectives. If attribute values that match the conditions are found in the message, and the number of triggered conditions matches the type of logical connective, the expression is triggered. All expressions that were triggered in accordance with Content Filtering settings of the rule are considered, and an action is selected to be applied to the message.

Creating an expression involves the following steps:

1. Configuring expression parameters
2. Configuring actions to be performed on messages when an expression is triggered
3. Creating Content Filtering conditions
4. Configuring a logical connective between conditions

To create a Content Filtering expression:

1. In the application web interface window, select the Rules section.
2. In the rule table, select the rule for which you want to create a Content Filtering expression.

   This opens the View rule window.

3. In the left pane, select the Content Filtering section.
4. Click Edit.

   Content Filtering settings become editable.

5. On the Main tab, in the Expressions table, click Create.

   This opens the Create expression window.

6. In the Expression name field, enter the name of the expression.

   The expression name must be unique within the rule.

7. If you want to change the priority of the created expression, in the Place drop-down list, specify the position of the created expression in the list of expressions.

   By default, the expression is assigned the highest priority of all previously created expressions.

8. Under Action if expression matched, select the action to be applied to the message when the expression is triggered:
   • Skip.

     Deliver message to recipient

   • Reject.

     Do not deliver message to recipient. Send SMTP session error code to the sender server if possible. If error code cannot be sent, send SMTP session success code to the sender server, and a non-delivery report is sent to the sender of the original message

   • Delete attachment.

     Deliver message without attachment to recipient

   • Delete message.

     Do not deliver message to recipient. Send SMTP session success code to the sender server. No non-delivery report is sent to the sender of the original message

   The Skip action is selected by default.

9. If you want to automatically place in Backup those messages that triggered a Content Filtering expression, turn on the Put original message to Backup toggle switch.

   This toggle switch is off by default.

10. If you want tags to be added automatically to the beginning of the subject of messages which triggered a Content Filtering expression, in the Text to add to message subject field, enter the text of the tag.
11. Under Conditions, create all the expression conditions that you need. We do not recommend using more than 15 conditions in one expression.
12. Specify the type of logical connective for conditions. To do so, in the Type of logical connection drop-down list, select one of the following values:
    • Only if all conditions match
    • If one or more conditions match

    By default, Only if all conditions match is selected.

13. If you want to remove message headers when an expression is triggered, under Actions on headers, in the Modify headers table, specify the headers you want to remove.

    Modifying or deleting headers may lead to DKIM authentication failure or non-delivery of the message

    The headers are removed if the action to be applied to the message is Skip, Delete attachment, or Disinfect.

    You can specify headers to be removed in the following ways:

    • Text

      To add a header, click Add, enter a header name, then click or press ENTER. If necessary, repeat this step to add more headers.

      To paste a header name from the clipboard, click Import, type or paste headers separated by semicolons or new lines, then click Import.

      If you want to edit a previously added header, click the header in the text box, make the necessary changes in edit mode and click . If necessary, use search.

      If you want to remove a header from the list, point to the header in the list and click the icon. To clear the list, click Delete all.

      The name of the header must contain only Latin letters (case-insensitive). The maximum length is 512 characters.

      You can copy all headers in the list to the clipboard. To do so, click Copy all.

      If not all headers are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

    • Wildcard

      To add a search mask, click Add, enter your text, then click or press ENTER. If necessary, repeat this step to add more masks.

      To paste masks from the clipboard, click Import, type or paste search masks separated by semicolons or new lines, then click Import.

      If you want to edit a previously added mask, click the mask in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

      If you want to remove a mask from the list, point to the mask in the list and click the icon. To clear the list, click Delete all.

      We do not recommend entering a mask longer than 1000 characters.

      You can copy all masks added to the list. To do so, click Copy all.

      If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

    • Regexp

      To add a regular expression, click Add, enter your regular expression, then click or press ENTER.

      Regular expressions of the PCRE format are supported.

      You do not need to prefix the string with "re:".

      If necessary, repeat this step to add more regular expressions.

      To paste regular expressions from the clipboard, click Import, type or paste regular expressions separated by semicolons or new lines, then click Import.

      If you want to edit a previously added regular expression, click the regular expression in the text box, make the necessary changes in edit mode and click . If necessary, use search.

      If you want to remove a regular expression from the list, point to the regular expression in the list and click the icon. To clear the list, click Delete all.

      We do not recommend entering a regular expression longer than 1000 characters.

      You can copy all regular expressions in the list. To do so, click Copy all.

      If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

14. If you want to modify message headers when an expression is triggered, under Actions on headers, in the Delete headers table, specify the headers you want to modify.

    The headers are modified if the action to be applied to the message is Skip, Delete attachment, or Disinfect. If the header is found in the message, it is removed, and a similar header with the specified value is added to the end of the list of headers. If the header is not present in the message, it is added to the end of the list of message headers.

    To add headers for editing, click Add, and in the displayed window, specify the name and value of the header that you want to modify, then click OK. If necessary, repeat these steps for other headers.

    The name and value of the header must contain only Latin letters (case-insensitive). The maximum length is 450 characters.

    If multiple expressions were triggered, and expressions with the strictest action are selected in accordance with the Content Filtering settings, the headers specified in expressions with that action are modified in the order determined in the descending order of the priority of the expression they occur in.

    You can remove headers from Modify headers. To do so, select the check boxes next to one or more headers that you want to remove, click Delete, and confirm the action.

15. In the Create expression window, click OK.
16. After creating all necessary expressions, in the Content Filtering rule in the Content Filtering window, click Save.

The Content Filtering expression is created.