Creating a Content Filtering expression

A Content Filtering expression consists of conditions that contain message attributes and their values. Conditions are combined by logical connections. If attribute values that match the conditions are found in the message, and the number of triggered conditions matches the type of logical connection, the expression is triggered. All expressions that were triggered in accordance with Content Filtering settings of the rule are considered, and an action is selected to be applied to the message.

Creating an expression involves the following steps:

1. Configuring expression parameters
2. Configuring actions to be performed on messages when an expression is triggered
3. Creating Content Filtering conditions
4. Configuring a logical connection between conditions
5. Configuring actions to be performed on message headers when an expression is triggered
6. Configuring notifications when an expression is triggered

To create a Content Filtering expression:

1. In the application web interface window, select the Rules section.
2. In the rule table, select the rule for which you want to create a Content Filtering expression.

   This opens the View rule window.

3. In the left pane, select the Content Filtering section.
4. Click Edit.

   Content Filtering settings become editable.

5. On the Main tab, in the Expressions table, click Create.

   This opens the Create expression window.

6. In the Expression name field, enter the name of the expression.

   The expression name must be unique within the rule.

7. If you want to change the priority of the created expression, in the Place drop-down list, specify the position of the created expression in the list of expressions.

   By default, the expression is assigned the highest priority of all previously created expressions.

8. Under Action if expression matched, select the action to be applied to the message when the expression is triggered:
   • Skip.
     

     Deliver message to recipient

   • Delete attachment.
     

     Deliver message without attachment to recipient

   • Reject.
     

     Do not deliver message to recipient. Send SMTP session error code to the sender server if possible. If error code cannot be sent, send SMTP session success code to the sender server, and a non-delivery report might be sent to the sender of the original message

   • Delete message.
     

     Do not deliver message to recipient. Send SMTP session success code to the sender server. No non-delivery report is sent to the sender of the original message

   The Skip action is selected by default.

9. If you want to automatically place in Backup those messages that triggered a Content Filtering expression, turn on the Place original message in Backup toggle switch.

   This toggle switch is off by default.

10. If you want tags to be added automatically to the beginning of the subject of messages which triggered a Content Filtering expression, in the Text to add to message subject field, enter the text of the tag.
11. Under Conditions, create all the expression conditions that you need.

    We do not recommend using more than 15 conditions in one expression.

12. Specify the type of logical connection for conditions. To do so, in the Type of logical connection drop-down list, select one of the following values:
    • Only if all conditions match
    • If one or more conditions match

    By default, Only if all conditions match is selected.

13. If you want to remove message headers when an expression is triggered, under Actions on headers, in the Delete headers table, specify the headers you want to remove.

    Modifying or deleting headers may lead to DKIM authentication failure or non-delivery of the message

    The headers are removed if the action to be applied to the message is Skip, Delete attachment, or Disinfect.

    You can specify headers to be removed in the following ways:

    • Text

      To add a header, click Add, enter a header name, then click or press Enter. If necessary, repeat this step to add more headers.

      The name of the header must contain only Latin letters (case-insensitive). The maximum length is 512 characters.

      To paste a header name from the clipboard, click Import, type or paste headers separated by semicolons or new lines, then click Import.

      If you want to edit a previously added header, click the header in the text box, make the necessary changes in edit mode and click . If necessary, use search.

      If you want to remove a header from the list, point to the header in the list and click the icon. To clear the list, click Delete all.

      You can copy all headers in the list to the clipboard. To do so, click Copy all.

      If not all headers are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

    • Wildcard

      To add a search mask, click Add, enter your text, then click or press Enter. If necessary, repeat this step to add more masks.

      We do not recommend entering a mask longer than 1000 characters.

      To paste masks from the clipboard, click Import, type or paste search masks separated by semicolons or new lines, then click Import.

      If you want to edit a previously added mask, click the mask in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

      If you want to remove a mask from the list, point to the mask in the list and click the icon. To clear the list, click Delete all.

      You can copy all masks added to the list. To do so, click Copy all.

      If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

    • Regexp

      To add a regular expression, click Add, enter your regular expression, then click or press Enter.

      Regular expressions of the PCRE format are supported. We do not recommend entering a regular expression longer than 1000 characters.

      You do not need to prefix the string with "re:".

      If necessary, repeat this step to add more regular expressions.

      To paste regular expressions from the clipboard, click Import, type or paste regular expressions separated by semicolons or new lines, then click Import.

      If you want to edit a previously added regular expression, click the regular expression in the text box, make the necessary changes in edit mode and click . If necessary, use search.

      If you want to remove a regular expression from the list, point to the regular expression in the list and click the icon. To clear the list, click Delete all.

      You can copy all regular expressions in the list. To do so, click Copy all.

      If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

14. If you want to modify message headers when an expression is triggered, under Actions on headers, in the Modify headers table, specify the headers you want to modify.

    The headers are modified if the action to be applied to the message is Skip, Delete attachment, or Disinfect. If the header is found in the message, it is removed, and a similar header with the specified value is added to the end of the list of headers. If the header is not present in the message, it is added to the end of the list of message headers.

    To add headers for editing, click Add, and in the displayed window, specify the name and value of the header that you want to modify, then click OK. If necessary, repeat these steps for other headers.

    The name and value of the header must contain only Latin letters (case-insensitive). The maximum length is 450 characters.

    If multiple expressions were triggered, and expressions with the strictest action are selected in accordance with the Content Filtering settings, the headers specified in expressions with that action are modified in the order determined in the descending order of the priority of the expression they occur in.

    You can remove headers from Modify headers. To do so, select the check boxes next to one or more headers that you want to remove, click Delete, and confirm the action.

15. If you want notifications to be sent when the expression is triggered, on the Notifications tab, click Add and configure the following:
    1. In the Template drop-down list, select a notification template.
    2. Under Recipients, select check boxes next to the recipients of the notification. Recipients may be:
       • Recipients from the general list.

         This option is available if the general list of recipients contains at least one email address.

       • Message sender.
       • Message recipients.
       • Custom addresses.
    3. If you selected the Custom addresses option, in the Custom addresses field, specify other email addresses of notification recipients.

       Use a semicolon or a new line to separate email addresses.

    4. Under Notification contents, select one of the following values:
       • Notification only.
       • Notification with the original message attached.

    If necessary, repeat the steps to configure as many notifications as you need.

    Rules for sending notifications

    If one expression in the rule is triggered, the configured notification is sent in accordance with its settings.

    If more than one expression is triggered in a rule, the following outcomes are possible:

    • If Apply the action of the expression with the highest priority, ignore other expressions is selected for When matches are found, and a notification is configured for the highest-priority expression, a notification is sent in accordance with the specified settings. For all other expressions, no notifications are sent, even if configured.

      If no notifications are configured for the highest-priority expression, no notifications are sent whatsoever.

    • If Apply the strictest of the actions of all matched expressions is selected for When matches are found, and a notification is configured for the expression with the strictest action, a notification is sent in accordance with the specified settings.

      If multiple expressions with the strictest action are triggered in a rule, and notifications are configured for them, notifications are sent for all triggered expressions with the strictest action for which notifications are configured. Notifications configured in expressions with less strict actions are not sent.

      If no notifications are configured for the expressions with the strictest action, no notifications are sent whatsoever.

16. In the Create expression window, click OK.

The Content Filtering expression is created.

After creating all necessary expressions, in the Content Filtering rule in the Content Filtering window, click Save.

Page top