Codes of settings of other Content Filtering conditions

If logging of audit events and modified settings is enabled in Event Log settings, when editing settings for types and names of attachments in the Content Filtering module, detailed information about the changes is recorded in an Audit Log event.

The following table shows how the settings of conditions for all attributes except attachment types and names are coded in an Audit Log record.

Codes of general condition settings in an audit event record

Condition setting in the Content Filtering module

Code in the audit event record

Examples

Status toggle switch in the Conditions table

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.
conditions{<condition number>,<message attribute>}.enable

Possible values:

  • true if the condition is enabled.
  • false if the condition is disabled.

The toggle switch is enabled automatically when the condition is created, and a corresponding audit event is logged.

Condition created:

scanSettings.cfScanSettings.expressions{1, Some expression name}.conditions{1, Subject}.enable[][true]

scanSettings.cfScanSettings.expressions{1, Some expression name}.conditions{1, Subject}.messageAttribute[][Subject]

Condition modified:

scanSettings.cfScanSettings.expressions{1, Some expression name}.conditions{1, Subject}.enable[true][false]

Condition deleted:

scanSettings.cfScanSettings.expressions{1, Some expression name}.conditions{1, From}.enable[false][]

scanSettings.cfScanSettings.expressions{1, Some expression name}.conditions{1, From}.messageAttribute[From][]

scanSettings.cfScanSettings.expressions{1, Some expression 2 name}.conditions{2, To}.Index[2][1]

scanSettings.cfScanSettings.expressions{1, Some expression 3 name}.conditions{3, Cc}.Index[3][2]

Message attribute in condition modified:

scanSettings.cfScanSettings.expressions{1, Some expression name}.conditions{1, Subject}.messageAttribute[Subject][]

scanSettings.cfScanSettings.expressions{1, Some expression name}.conditions{1, Subject}.enable[true][]

scanSettings.cfScanSettings.expressions{1, Some expression name}.conditions{1, Subject}.Index[1][]

scanSettings.cfScanSettings.expressions{1, Some expression name}.conditions{1, Body}.messageAttribute[][Body]

scanSettings.cfScanSettings.expressions{1, Some expression name}.conditions{1, Body}.enable[][true]

scanSettings.cfScanSettings.expressions{1, Some expression name}.conditions{1, Body}.Index[][1]

Serial number of the condition

Internal setting, not displayed in the web interface.

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.Index

This setting is logged when a condition that is followed by other conditions in the list is removed.

Message attribute

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.
conditions{<condition number>, <message attribute>}.
messageAttribute

Possible values of the message attribute:

  • AttachmentFormat
  • AttachmentName
  • MessageSize
  • Subject
  • Body
  • Header
  • From
  • To
  • Cc

Modifying a message attribute in a condition is logged as a deletion of the condition with the old message attribute and a creation of a new condition with the new message attribute.

Codes of condition settings for the From, To, CC, Subject, and Body attributes in an audit event record

Condition setting for a From, To, CC, Subject, or Body attribute

Code in the audit event record

Examples

Criterion

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.
conditions{<condition number>, <
message attribute>}.<message attribute>.
conditionType

Possible values:

  • InList if Attachment type matches at least one item listed below is selected.
  • NotInList if Attachment type does not match any item listed below is selected.

For From, To, CC attributes, the following values are also valid:

  • IsEmpty if Empty list of senders is selected.
  • IsNotEmpty if Non-empty list of senders is selected.

Condition created:

scanSettings.cfScanSettings.expressions{1,
Some expression name}.conditions{1,
From}.from.conditionType[][InList]

Condition modified:

scanSettings.cfScanSettings.expressions{1,
Some expression name}.conditions{1,
From}.from.conditionType[InList][NotInList]

Condition deleted:

scanSettings.cfScanSettings.expressions{1,
Some expression name}.conditions{1,
From}.from.conditionType[NotInList][]

Text

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.
conditions{<condition number>, <
message attribute>}.<message attribute>.
inlineValues.textList

Condition created:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.
from.inlineValues.textList.Added[Abc Def]

Condition modified:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.
from.inlineValues.textList.Added[Ghi Xyz]

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.
from.inlineValues.textList.Removed[Def]

Condition deleted:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.
from.inlineValues.textList.Removed[Abc Ghi Xyz]

Wildcard

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.
conditions{<condition number>, <
message attribute>}.<message attribute>.
inlineValues.wildcardList

Condition created:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
inlineValues.wildcardList.Added[%2A@some_mail.com]

Condition modified:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
inlineValues.wildcardList.Added[%2A@another_mail.com]

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
inlineValues.wildcardList.Removed[%2A@some_mail.com]

Condition deleted:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
inlineValues.wildcardList.Removed[%2A@another_mail.com]

Regexp

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.
conditions{<condition number>, <
message attribute>}.<message attribute>.
inlineValues.regexList

Condition created:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.
from.inlineValues.regexList.Added[X-KSMG.+]

Condition modified:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
inlineValues.regexList.Added[X-MS.+]

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
inlineValues.regexList.Removed[X-KSMG.+]

Condition deleted:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
inlineValues.regexList.Removed[X-MS.+]

Dictionaries

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.
conditions{<condition number>, <
message attribute>}.<message attribute>.
dictionaries

The record will contain the IDs of the connected or disconnected dictionaries.

Condition created:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
dictionaries.Added[1 2]

Condition modified:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
dictionaries.Added[3]

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
dictionaries.Removed[1]

Condition deleted:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
dictionaries.Removed[2 3]

Codes of condition settings for the Header attribute in an audit event record

Condition setting for a Header attribute

Code in the audit event record

Examples

Header name

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.
conditions{<condition number>, Header}.
header.headerName

Condition created:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,Header}.header.
headerName[][X-MS-Exchange-Abc]

Condition modified:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,Header}.header.
headerName[X-MS-Exchange-Abc][X-PT-Abc]

Condition deleted:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,Header}.header.
headerName[X-PT-Abc][]

Criterion

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.
conditions{<condition number>, Header}.
header.conditionType

Possible values:

  • InList if Header value contains at least one item listed below is selected.
  • NotInList if Header value does not contain any item listed below is selected.

Condition created:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,Header}.header.
conditionType[][InList]

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,Header}.header.
matchingMode[][FullMatch]

Condition modified:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,Header}.header.
conditionType[InList][NotInList]

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,Header}.header.
matchingMode[FullMatch][SubstringMatch]

Condition deleted:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,Header}.header.
conditionType[NotInList][]

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,Header}.header.
matchingMode[SubstringMatch][]

Strictness of the condition

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.
conditions{<condition number>, Header}
.header.matchingMode

Possible values:

  • FullMatch if Value matches at least one item is selected.
  • SubstringMatch if Value contains at least one item is selected.

Text

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.
conditions{<condition number>, Header}.
header.inlineValues.textList

Condition created:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,Header}.header.
inlineValues.textList.Added[Abc Def]

Condition modified:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,Header}.header.
inlineValues.textList.Added[Ghi Xyz]

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,Header}.header.
inlineValues.textList.Removed[Def]

Condition deleted:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,Header}.header.
inlineValues.textList.Removed[Abc Ghi Xyz]

Wildcard

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.
conditions{<condition number>, Header}.
header.inlineValues.wildcardList

Condition created:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
inlineValues.wildcardList.Added[%2A@company_1.com
%2A@company_2.com]

Condition modified:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
inlineValues.wildcardList.Added[%2A@company_3.com
%2A@company_4.com]

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
inlineValues.wildcardList.Removed
[%2A@company_2.com]

Condition deleted:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
inlineValues.wildcardList.Removed[%2A@company_1.com
%2A@company_3.com %2A@company_4.com]

Regexp

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.
conditions{<condition number>, Header}.
header.inlineValues.regexList

Condition created:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
inlineValues.

regexList.Added[.+@(1_company|2_company)%5C.
(com|org|info)]

Condition modified:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
inlineValues.regexList.Added[.+@(1_company|2_company)
%5C.(com|org|io|info)]

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
inlineValues.regexList.Removed[.+@(1_company|
2_company)%5C.(com|org|info)]

Condition deleted:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1, From}.from.
inlineValues.regexList.Removed[.+@(1_company|
2_company)%5C.(com|org|io|info)]

Dictionaries

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.
conditions{<condition number>, Header}.
header.dictionaries

The record will contain the IDs of the connected or disconnected dictionaries.

Condition created:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,Header}.header.
dictionaries.Added[1 2]

Condition modified:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,Header}.header.
dictionaries.Added[3]

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,Header}.header.
dictionaries.Removed[1]

Condition deleted:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,Header}.header.
dictionaries.Removed[2 3]

Codes of condition settings for the Message size attribute in an audit event record

Condition setting for a Message size attribute

Code in the audit event record

Examples

Criterion

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.
conditions{<condition number>,MessageSize}.
messageSize.relation

Possible values:

  • Less if Less than (<) is selected.
  • Greater if Greater than (>) is selected.

Condition created:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,MessageSize}.messageSize.
referenceSize[][500]

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,MessageSize}.messageSize.
relation[][Greater]

Condition modified:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,MessageSize}.messageSize.
referenceSize[500][10240]

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,MessageSize}.messageSize.
relation[Greater][Less]

Condition deleted:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,MessageSize}.messageSize.
referenceSize[10240][]

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,MessageSize}.messageSize.
relation[Less][]

Size

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.
conditions{<condition number>,MessageSize}.
messageSize.referenceSize

Possible values: non-negative integers. Regardless of the units of measurement selected, the number represents the message size in bytes.

Unit of measurement

The parameter is not logged.

Codes of condition settings for the MIME part size attribute in an audit event record

Condition setting for a MIME part size attribute

Code in the audit event record

Examples

Criterion

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.
conditions{<expression number>,PartSize}.
PartSize.relation

Possible values:

  • Less if Less than (<) is selected.
  • Greater if Greater than (>) is selected.

Condition created:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,MessageSize}.messageSize.
referenceSize[][500]

scanSettings.cfScanSettings.expressions{1, Some expression name}.conditions{1,MessageSize}.messageSize.
relation[][Greater]

Condition modified:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,MessageSize}.messageSize.
referenceSize[500][10240]

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,MessageSize}.messageSize.
relation[Greater][Less]

Condition deleted:

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,MessageSize}.messageSize.
referenceSize[10240][]

scanSettings.cfScanSettings.expressions{1, Some
expression name}.conditions{1,MessageSize}.messageSize.
relation[Less][]

Size

scanSettings.cfScanSettings.expressions
{<expression number>, <expression name>}.
conditions{<condition number>,PartSize}.
PartSize.referenceSize

Possible values: non-negative integers. Regardless of the units of measurement selected, the number represents the message size in bytes.

Unit of measurement

The parameter is not logged.

Page top