Kaspersky Secure Mail Gateway

Configuring Content Filtering

To configure Content Filtering settings in the message processing rule:

1. In the application web interface window, select the Rules section.
2. In the rule table, select the rule for which you want to configure Content Filtering.

   This opens the View rule window.

3. In the left pane, select the Content Filtering section.
4. Click Edit.

   Content Filtering settings become editable.

5. On the Main tab, select the message processing mode when multiple expressions are triggered:
   • Apply the action of the expression with the highest priority, ignore other expressions
   • Apply the strictest of the actions of all matched expressions

     If multiple expressions with different actions are triggered, the expressions with the strictest action is selected (in descending order of strictness: Delete message → Reject → Delete attachment → Skip).

6. In the Expressions table, click Create and create Content Filtering expressions.
7. On the Actions on scan error tab, configure the actions the application applies in case the Content Filtering module returns an error.
   1. Select the action to apply to the message:
      • Skip.
      • Reject.
      • Delete message.

      The Skip action is selected by default.

   2. If you want to automatically place in Backup those messages that were not processed by the Content Filtering module because of an error, turn on the Put original message to Backup toggle switch.
   3. If you want to add some text to the subject of messages that could not be processed by the Content Filtering module because of an error, in the Text to add to message subject field, enter the text you want to add.
   4. If you want to remove message headers in case of a Content Filtering module error, in the Delete headers field, specify the headers that you want to remove.

      Modifying or deleting headers may lead to DKIM authentication failure or non-delivery of the message

      Headers are removed if a Skip, Delete attachment, or Disinfect action is taken on the message.

      You can specify headers to be removed on the following tabs:

      • Text

        To add a header, click Add, enter a header name, then click or press Enter. If necessary, repeat this step to add more headers.

        The name of the header must contain only Latin letters (case-insensitive). The maximum length is 512 characters.

        To paste a header name from the clipboard, click Import, type or paste headers separated by semicolons or new lines, then click Import.

        If you want to edit a previously added header, click the header in the text box, make the necessary changes in edit mode and click . If necessary, use search.

        If you want to remove a header from the list, point to the header in the list and click the icon. To clear the list, click Delete all.

        You can copy all headers in the list to the clipboard. To do so, click Copy all.

        If not all headers are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

      • Wildcard

        To add a search mask, click Add, enter your text, then click or press Enter. If necessary, repeat this step to add more masks.

        We do not recommend entering a mask longer than 1000 characters.

        To paste masks from the clipboard, click Import, type or paste search masks separated by semicolons or new lines, then click Import.

        If you want to edit a previously added mask, click the mask in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

        If you want to remove a mask from the list, point to the mask in the list and click the icon. To clear the list, click Delete all.

        You can copy all masks added to the list. To do so, click Copy all.

        If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

      • Regexp

        To add a regular expression, click Add, enter your regular expression, then click or press Enter.

        Regular expressions of the PCRE format are supported. We do not recommend entering a regular expression longer than 1000 characters.

        You do not need to prefix the string with "re:".

        If necessary, repeat this step to add more regular expressions.

        To paste regular expressions from the clipboard, click Import, type or paste regular expressions separated by semicolons or new lines, then click Import.

        If you want to edit a previously added regular expression, click the regular expression in the text box, make the necessary changes in edit mode and click . If necessary, use search.

        If you want to remove a regular expression from the list, point to the regular expression in the list and click the icon. To clear the list, click Delete all.

        You can copy all regular expressions in the list. To do so, click Copy all.

        If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

   5. If you want to modify message headers in case of a Content Filtering module error, in the Modify headers field, specify the headers that you want to modify.

      Headers are modified if a Skip, Delete attachment, or Disinfect action is taken on the message.

      If the header is found in the message, it is removed, and a similar header with the specified value is added to the end of the list of headers. If the header is not present in the message, it is added to the end of the list of message headers.

      To add headers for editing, click Add, and in the displayed window, specify the name and value of the header that you want to modify, then click OK. If necessary, repeat these steps for other headers.

      The name and value of the header must contain only Latin letters (case-insensitive). The maximum length is 450 characters.

      You can remove headers from Modify headers. To do so, select the check boxes next to one or more headers that you want to remove, click Delete, and confirm the action.

8. Click Save.

General configuration of Content Filtering is complete.