Kaspersky Secure Mail Gateway

Configuring Content Filtering

Content Filtering allows you to flexibly configure the processing rules for incoming and outgoing mail. For example, you can add your own conditions for detecting spam or phishing that are not yet available in the databases of the Anti-Spam and Anti-Phishing scan modules, or block messages with forbidden words in body or subject.

You can configure Content Filtering based on the following message attributes:

• Message size.
• Names of attachments, including those inside archives and compound objects
• Types of attachments

  KSMG allows you to determine the true format and type of an attachment, regardless of its extension, including inside archives and compound objects.

• Message subject.
• Message body.
• Sender (From MIME header).
• Recipient (To MIME header).
• Recipient of a copy of the message
• Top-level header of the MIME structure of the message

Examples of filtering incoming mail by message attributes

The attribute that the message is filtered by is specified in the condition. Conditions are combined into an expression using a logical connection.

An expression is a set of parameters for one message filter. Expressions contain Content Filtering conditions, logical connections of a certain type that interrelate conditions, and the action to be performed with the message if the expression is triggered. An expression is considered to be triggered if attribute values that match the conditions are found in the message, and the number of triggered conditions matches the type of logical connection. A condition is considered to be triggered if an attribute is found in a message whose value matches the condition.

If a scan resulted in multiple expressions triggering, depending on expression parameters, an action with the highest priority or the strictest action is taken (Delete message → Reject → Delete attachment → Skip).

We do not recommend using more than 10 expressions in one rule.

Content Filtering works if the Content Filtering module is enabled in the rule settings and at least one active expression exists with at least one active condition.

Configuring Content Filtering involves the following steps:

1. Enabling Content Filtering in general protection settings
2. Enabling Content Filtering in rule settings
3. Configuring Content Filtering

   At this step, you can configure an action to be performed on the message in case multiple expressions are triggered or in case of an error occurs with Content Filtering.

4. Creating a Content Filtering expression

   Creating an expression involves the following steps:

   1. Configuring expression parameters
   2. Creating Content Filtering conditions

After that, Content Filtering is configured. The specified actions are applied to messages that match the rule criteria.

To make sure that the configured settings are applied by KSMG, enable the configured rule.