Codes of Content Filtering module settings

If logging of audit events and modified settings is enabled in Event Log settings, when settings of the Content Filtering module are edited, detailed information about the changes is recorded in an Audit Log event.

The following table shows how the settings of the Content Filtering module are coded in an Audit Log record.

Codes of settings from the Content Filtering → Main section in the audit event record

Content Filtering → Main setting

Code in the audit event record

Examples

Content Filtering switch in the left pane

scanSettings.cfScanSettings.
engineSettings.enableScan

Possible values:

  • true if the toggle switch is On.
  • false if the toggle switch is Off.

Rule created:

scanSettings.cfScanSettings.engineSettings.
enableScan[][false]

scanSettings.cfScanSettings.actionSelectionPolicy[]
[HighestPriorityExpressionAction]

Rule modified:

scanSettings.cfScanSettings.engineSettings.
enableScan[false][true]

scanSettings.cfScanSettings.actionSelectionPolicy
[HighestPriorityExpressionAction][StrictestAction]

Rule removed

scanSettings.cfScanSettings.engineSettings.enableScan
[true][]

scanSettings.cfScanSettings.actionSelectionPolicy
[StrictestAction][]

When matches are found

scanSettings.cfScanSettings.
actionSelectionPolicy

Possible values:

  • HighestPriorityExpressionAction if the Apply the action of the expression with the highest priority, ignore other expressions action is selected.
  • StrictestAction if the Apply the strictest of the actions of all matched expressions action is selected.

Codes of settings from the Content Filtering → Actions on scan error section in the audit event record

Content Filtering → Actions on scan error setting

Code in the audit event record

Examples

Actions on scan error tab, If content filtering error occurred group of settings

Action

scanSettings.cfScanSettings.
errorActions.action

Possible values:

  • Skip if the Skip action is selected.
  • Reject if the Reject action is selected.
  • DeleteMessage if the Delete message action is selected.

Rule created:

scanSettings.cfScanSettings.errorActions.action[][Skip]

scanSettings.cfScanSettings.errorActions.backup[][false]

scanSettings.cfScanSettings.errorActions.mark[][%5BERROR%5D]

Rule modified:

scanSettings.cfScanSettings.errorActions.action[Skip][Reject]

scanSettings.cfScanSettings.errorActions.backup[false][true]

scanSettings.cfScanSettings.errorActions.mark[%5BERROR%5D]
[%5BCF ERROR%5D]

Rule removed

scanSettings.cfScanSettings.errorActions.action[Reject][]

scanSettings.cfScanSettings.errorActions.backup[true][]

scanSettings.cfScanSettings.errorActions.mark[%5BCF ERROR%5D][]

Place original message in Backup

scanSettings.cfScanSettings.
errorActions.backup

Possible values:

  • true if the toggle switch is On.
  • false if the toggle switch is Off.

Text to add to message subject

scanSettings.cfScanSettings.
errorActions.mark

Actions on scan error tab, Additional settings group of settings

Delete headers – Text

scanSettings.cfScanSettings.
errorActions.headersToChange.
headersToDelete.textList

For changes on the Text tab:

Rule created:

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToDelete.textList.Added[X-MS-Exchange-Abc X-MS-Exchange-Def]

Rule modified:

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToDelete.textList.Added[X-MS-Exchange-Ghi X-MS-Exchange-Xyz]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToDelete.textList.Removed[X-MS-Exchange-Def]

Rule removed

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToDelete.textList.Removed[X-MS-Exchange-Abc X-MS-Exchange-Ghi X-MS-Exchange-Xyz]

Delete headers – Wildcard

scanSettings.cfScanSettings.
errorActions.headersToChange.
headersToDelete.wildcardList

Delete headers – Regexp

scanSettings.cfScanSettings.
errorActions.headersToChange.
headersToDelete.regexList

Modify headers

scanSettings.cfScanSettings.
errorActions.headersToChange.
headersToModify

Values in the list are represented as pairs of records: one record for the header name, and another for the value.

If a header is added or removed, such an event is represented by two records:

1. A record with the added or removed header in the following form:

scanSettings.cfScanSettings.
errorActions.headersToChange.
headersToModify{N}.<header name>

2. A record with the value of the added or removed header in the following form:

scanSettings.cfScanSettings.
errorActions.headersToChange.
headersToModify{N}.<header value>

If only the header is changed, the modifications of the pair are represented by a single record of the following form:

scanSettings.cfScanSettings.
errorActions.headersToChange.
headersToModify{N}.<header name>

If only the value of the header is changed, the modifications of the pair are represented by a single record of the following form:

scanSettings.cfScanSettings.
errorActions.headersToChange.
headersToModify{N}.<header value>

Where N is the serial number of the pair in the list of pairs.

If the serial number of a line changes, the modifications of the pair are represented by a single record of the following form:

scanSettings.cfScanSettings.
errorActions.headersToChange.
headersToModify{N}.<serial number>

Rule created

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{1}.name[][X-MS-Exchange-Abc]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{1}.value[][123]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{2}.name[][X-MS-Exchange-Def]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{2}.value[][456]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{3}.name[][X-MS-Exchange-Ghi]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{3}.value[][789]

Rule modified

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{1}.name[X-MS-Exchange-Abc][]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{1}.value[123][]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{2}.value[456][444]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{2}.index[2][1]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{3}.name[X-MS-Exchange-Ghi][X-PT-Ghi]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{3}.index[3][2]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{3}.name[][X-MS-Exchange-Xyz]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{3}.value[][111]

Rule removed

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{1}.name[X-MS-Exchange-Def][]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{1}.value[444][]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{2}.name[X-PT-Ghi][]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{2}.value[789][]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{3}.name[X-MS-Exchange-Def][]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{3}.value[111][]

Page top