Creating a Content Filtering condition

Expand all | Collapse all

To create a Content Filtering condition:

1. In the application web interface window, select the Rules section.
2. In the rule table, select the rule for which you want to create a Content Filtering expression.

   This opens the View rule window.

3. In the left pane, select the Content Filtering section.
4. Click Edit.

   Content Filtering settings become editable.

5. Under Expressions, click Create.

   This opens the Create expression window.

6. Under Conditions, click Create.

   This opens the Create condition window.

7. In the Message attribute drop-down list, select the attribute for which you want to configure the filtering condition:
   • Attachment type

     To find messages that contain nested objects of a specific type:

     1. Select the criterion that decides that the condition is satisfied:
        • Attachment type matches at least one item listed below
        • Attachment type does not match any item listed below

          When you select this criterion under Search types on the File types tab, the check boxes next to the HTML, HTM, TXT types are automatically selected. This makes sure that the message is not accidentally damaged, rejected, or deleted if the condition is triggered and the final action on the message is Delete attachment, Reject, or Delete message.

     2. If necessary, select the check boxes for additional settings:
        • If you want to check for specific file types inside compound objects, select the Scan compound objects check box.

          If you enable scanning compound objects, the Check file types in archives check box is selected automatically because archives are a subset of compound objects.

        • If you want to check for specific file types inside archives, select the Check file types in archives check box.
     3. Under Search types, specify the types of attachments that you want to look for in messages:
        • On the File types tab, select the check boxes next to the attachment types that you want to look for.
          • Archives: 7Z (including volumes with 7Z* extensions), ACE, ARJ, BZ, BZ2, TBZ, TBZ2, CAB, DMG, SMI, IMG, GZ, TGZ, ISO, JAR, RAR, TAR, XAR, ZIP
          • Databases: ACCDB, ACCDE, ACCDP, ACCDR, ACCDC, MDB, MDT.
          • Executable files: APK, SCPT, APPLESCRIPT, BAT, CMD, DEB, DEX, ODEX, ELF, CLASS, JS, O, DYLIB, MSI, PYC, PYO, RPM, SH, PL, VBS, EXE, DLL, OCX, SCR, LNK.

            For APPLESCRIPT and SCPT attachment types, Content Filtering detects only compiled files.

          • Image files:
            • Animated files: SWF
            • Bitmap images: BMP, GIF, JPG, JPE, JPEG, JFIF, PNG, APNG, TIF, TIFF
            • Vector graphics: CDR, EMF, WMF, EPS, PSD
          • Multimedia files:
            • Audio files: AAC, M4A, AC3, APE, CDA, FLAC, MID, MIDI, MKA, MP3, OGG, RM, RA, RAVB, WAV, WMA
            • Video files: 3GP, 3G2, 3GP2, 3P2, ASF, WMV, AVI, BIK, F4V, FLV, MKV, MOV, QT, DIVX, MP4, RM, RMVB, RTMP, VOB, DAT, MPG, MPEG
          • Document files:
            • Documents: DOC, DOCM, DOCX, DOT, DOTM, DOTX, ODT, PDF, RTF, SXW, XPS
            • Presentations: POTM, POTX, PPSM, PPSX, PPT, POT, PPS, PPTM, PPTX, SLDX, ODP
            • Specialized files: PUB, MSG, OFT, ONE, ONEPKG, VDX, VSX, VTX, VSD, VSS, VST, XSN
            • Spreadsheets: XLAM, XLS, XLT, XLSB, XLSM, XLSX, XLTM, XLTX, ODS
          • Miscellaneous: CAT, HTML, HTM, TXT, CHM, REG
          • Other file types. These include unrecognized file types and file types that do not match any of the listed types.
        • On the Dictionaries tab, select the check boxes next to the dictionaries that contain the set of file types that you need.

          If necessary, use the search bar.

          The total number of dictionaries of the File types type and the number of dictionaries used in the condition is displayed above the search. If not all dictionaries are displayed in the window, you can select the number of dictionaries you want to display in the drop-down list in the lower part of the dictionary table.

     4. Click OK.
   • Attachment name

     To find messages that contain nested objects with specific names:

     1. Select the criterion that decides that the condition is satisfied:
        • Attachment name matches at least one item listed below
        • Attachment name does not match any item listed below
     2. If necessary, select the check boxes for additional settings:
        • If you want to scan for banned file names within compound objects, select the Scan compound objects check box.

          If you enable scanning compound objects, the Check file names in archives check box is selected automatically because archives are a subset of compound objects.

        • If you want to scan for banned file names inside archives, select the Check file names in archives check box.
     3. Under Search text, specify the names of attachments that you want to look for in messages.

        You can specify the names of attachments in the following ways:

        • Text

          To add some text, click Add, enter your text, then click or press ENTER. If necessary, repeat this step to add more strings.

          To paste text from the clipboard, click Import, type or paste text strings separated by semicolons or new lines, then click Import.

          If you want to edit a previously text string, click it in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

          If you want to remove a string from the list, point to the header in the list and click the icon. To clear the list, click Delete all.

          We do not recommend entering a string longer than 1000 characters.

          You can copy all text strings in the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Wildcard

          To add a search mask, click Add, enter your text, then click or press Enter. If necessary, repeat this step to add more masks.

          We do not recommend entering a mask longer than 1000 characters.

          To paste masks from the clipboard, click Import, type or paste search masks separated by semicolons or new lines, then click Import.

          If you want to edit a previously added mask, click the mask in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

          If you want to remove a mask from the list, point to the mask in the list and click the icon. To clear the list, click Delete all.

          You can copy all masks added to the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Regexp

          To add a regular expression, click Add, enter your regular expression, then click or press ENTER.

          Regular expressions of the PCRE format are supported. The search is performed in multi-line mode.

          Examples

          When searching in the body of the message using a regular expression of the ^test_pattern$ form, the condition is triggered for messages whose body consists of only the test_pattern string (no leading or trailing spaces), as well as for messages whose body contains at least one string consisting only of test_pattern (no leading or trailing spaces).

          If the condition must be triggered only for messages whose entire body consists of only the test_pattern string (without leading or trailing spaces), use the \Atest_pattern\z regular expression.

          You do not need to prefix the string with "re:".

          If necessary, repeat this step to add more regular expressions.

          To paste regular expressions from the clipboard, click Import, type or paste regular expressions separated by semicolons or new lines, then click Import.

          If you want to edit a previously added regular expression, click the regular expression in the text box, make the necessary changes in edit mode and click . If necessary, use search.

          If you want to remove a regular expression from the list, point to the regular expression in the list and click the icon. To clear the list, click Delete all.

          We do not recommend entering a regular expression longer than 1000 characters.

          You can copy all regular expressions in the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Dictionaries

          Select the check boxes next to the dictionaries that contain the set of strings that you want to use.

          If necessary, use the search bar.

          The total number of dictionaries of the Strings type and the number of dictionaries used in the condition is displayed above the search. If not all dictionaries are displayed in the window, you can select the number of items you want to display in the drop-down list in the lower part of the dictionary table.

     All values specified on the tabs are combined into a list of search strings. Each attachment name in the scanned message is checked for an exact match (case-insensitive) against each search string.

     The number of strings on all tabs under Search text, including imported strings, must not exceed 5000.

   • Message size

     To find messages of a specific size:

     1. Under Criterion, select a message size comparison criterion:
        • Less than (<).
        • Greater than (>).

        The default value is Greater than (>).

     2. In the Size field, enter the value with which you want to compare the size of the message.

        You can enter a non-negative integer value.

        If the value is set to 0, no size restrictions are applied. The default value is 0.

     3. In the Unit of measurement field, specify the unit of measurement to use for the restriction. Possible values:
        • B
        • KB
        • MB

        The default value is B.

     4. Click OK.
   • MIME part size

     Body sizes are determined only for those MIME parts that are leaves in the MIME structure tree, as well as for prologues and epilogues. The header size of the MIME part is not taken into account.
     If the MIME part is a compound object, the size of the entire object is calculated.

     To find a MIME part of a certain size:

     1. Under Criterion, select a MIME part size comparison criterion:
        • Less than (<).
        • Greater than (>).

        The default value is Greater than (>).

     2. In the Size field, enter the value with which you want to compare the sizes of MIME parts.

        You can enter a non-negative integer value.

        If the value is set to 0, no size restrictions are applied. The default value is 0.

     3. In the Unit of measurement field, specify the unit of measurement to use for the restriction. Possible values:
        • B
        • KB
        • MB

        The default value is B.

     4. Click OK.

     If the message being scanned contains another message as an attachment, the size of the whole attached message is counted as the size of one MIME part.

     If another message is embedded in the body of the message being scanned, the sizes of the leaves, prologues, and epilogues of the embedded message are counted as MIME part sizes.

   • Subject

     To find messages with specific subjects:

     1. Select the criterion that decides that the condition is satisfied:
        • Subject contains at least one item listed below
        • Subject does not contain any item listed below
     2. Under Search text, specify the subjects that you want to look for in messages.

        You can specify the subjects in the following ways:

        • Text

          To add some text, click Add, enter your text, then click or press ENTER. If necessary, repeat this step to add more strings.

          To paste text from the clipboard, click Import, type or paste text strings separated by semicolons or new lines, then click Import.

          If you want to edit a previously text string, click it in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

          If you want to remove a string from the list, point to the header in the list and click the icon. To clear the list, click Delete all.

          We do not recommend entering a string longer than 1000 characters.

          You can copy all text strings in the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Wildcard

          To add a search mask, click Add, enter your text, then click or press Enter. If necessary, repeat this step to add more masks.

          We do not recommend entering a mask longer than 1000 characters.

          To paste masks from the clipboard, click Import, type or paste search masks separated by semicolons or new lines, then click Import.

          If you want to edit a previously added mask, click the mask in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

          If you want to remove a mask from the list, point to the mask in the list and click the icon. To clear the list, click Delete all.

          You can copy all masks added to the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Regexp

          To add a regular expression, click Add, enter your regular expression, then click or press ENTER.

          Regular expressions of the PCRE format are supported. The search is performed in multi-line mode.

          Examples

          When searching in the body of the message using a regular expression of the ^test_pattern$ form, the condition is triggered for messages whose body consists of only the test_pattern string (no leading or trailing spaces), as well as for messages whose body contains at least one string consisting only of test_pattern (no leading or trailing spaces).

          If the condition must be triggered only for messages whose entire body consists of only the test_pattern string (without leading or trailing spaces), use the \Atest_pattern\z regular expression.

          You do not need to prefix the string with "re:".

          If necessary, repeat this step to add more regular expressions.

          To paste regular expressions from the clipboard, click Import, type or paste regular expressions separated by semicolons or new lines, then click Import.

          If you want to edit a previously added regular expression, click the regular expression in the text box, make the necessary changes in edit mode and click . If necessary, use search.

          If you want to remove a regular expression from the list, point to the regular expression in the list and click the icon. To clear the list, click Delete all.

          We do not recommend entering a regular expression longer than 1000 characters.

          You can copy all regular expressions in the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Dictionaries

          Select the check boxes next to the dictionaries that contain the set of strings that you want to use.

          If necessary, use the search bar.

          The total number of dictionaries of the Strings type and the number of dictionaries used in the condition is displayed above the search. If not all dictionaries are displayed in the window, you can select the number of items you want to display in the drop-down list in the lower part of the dictionary table.

     All values specified on the tabs are combined into a list of search strings. The subject of the scanned message is checked for occurrences of search strings (case-insensitive).

   • Body

     To find messages with specific content in the body:

     1. Select the criterion that decides that the condition is satisfied:
        • Body contains at least one item listed below
        • Body does not contain any item listed below
     2. Under Search text, specify the subjects that you want to look for in messages.

        You can specify the subjects in the following ways:

        • Text

          To add some text, click Add, enter your text, then click or press ENTER. If necessary, repeat this step to add more strings.

          To paste text from the clipboard, click Import, type or paste text strings separated by semicolons or new lines, then click Import.

          If you want to edit a previously text string, click it in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

          If you want to remove a string from the list, point to the header in the list and click the icon. To clear the list, click Delete all.

          We do not recommend entering a string longer than 1000 characters.

          You can copy all text strings in the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Wildcard

          To add a search mask, click Add, enter your text, then click or press Enter. If necessary, repeat this step to add more masks.

          We do not recommend entering a mask longer than 1000 characters.

          To paste masks from the clipboard, click Import, type or paste search masks separated by semicolons or new lines, then click Import.

          If you want to edit a previously added mask, click the mask in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

          If you want to remove a mask from the list, point to the mask in the list and click the icon. To clear the list, click Delete all.

          You can copy all masks added to the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Regexp

          To add a regular expression, click Add, enter your regular expression, then click or press ENTER.

          Regular expressions of the PCRE format are supported. The search is performed in multi-line mode.

          Examples

          When searching in the body of the message using a regular expression of the ^test_pattern$ form, the condition is triggered for messages whose body consists of only the test_pattern string (no leading or trailing spaces), as well as for messages whose body contains at least one string consisting only of test_pattern (no leading or trailing spaces).

          If the condition must be triggered only for messages whose entire body consists of only the test_pattern string (without leading or trailing spaces), use the \Atest_pattern\z regular expression.

          You do not need to prefix the string with "re:".

          If necessary, repeat this step to add more regular expressions.

          To paste regular expressions from the clipboard, click Import, type or paste regular expressions separated by semicolons or new lines, then click Import.

          If you want to edit a previously added regular expression, click the regular expression in the text box, make the necessary changes in edit mode and click . If necessary, use search.

          If you want to remove a regular expression from the list, point to the regular expression in the list and click the icon. To clear the list, click Delete all.

          We do not recommend entering a regular expression longer than 1000 characters.

          You can copy all regular expressions in the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Dictionaries

          Select the check boxes next to the dictionaries that contain the set of strings that you want to use.

          If necessary, use the search bar.

          The total number of dictionaries of the Strings type and the number of dictionaries used in the condition is displayed above the search. If not all dictionaries are displayed in the window, you can select the number of items you want to display in the drop-down list in the lower part of the dictionary table.

     All values specified on the tabs are combined into a list of search strings. The body of the scanned message is checked for occurrences of search strings (case-insensitive).

   • Header

     To find messages with specific headers:

     1. In the Header name field enter the name of the header whose value you want the application to check. This value is case-insensitive.

        For example, X-MS-Exchange-Organization-PCL.

        Only one header can be specified in the field.

     2. Select the criterion that decides that the condition is satisfied:
        • Header value contains at least one item listed below

          If you select this criterion, specify how strictly it is applied:

          • Value matches at least one item
          • Value contains at least one item
        • Header value does not contain any item listed below

          If you select this criterion, specify how strictly it is applied:

          • Value matches at least one item
          • Value contains at least one item
        • Header exists
        • Header does not exist
     3. If you select the Header value contains at least one item listed below or Header value does not contain any item listed below criterion, under Search text, enter the text you want to look for in the message header.

        You can specify the search text in the following ways:

        • Text

          To add some text, click Add, enter your text, then click or press ENTER. If necessary, repeat this step to add more strings.

          To paste text from the clipboard, click Import, type or paste text strings separated by semicolons or new lines, then click Import.

          If you want to edit a previously text string, click it in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

          If you want to remove a string from the list, point to the header in the list and click the icon. To clear the list, click Delete all.

          We do not recommend entering a string longer than 1000 characters.

          You can copy all text strings in the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Wildcard

          To add a search mask, click Add, enter your text, then click or press Enter. If necessary, repeat this step to add more masks.

          We do not recommend entering a mask longer than 1000 characters.

          To paste masks from the clipboard, click Import, type or paste search masks separated by semicolons or new lines, then click Import.

          If you want to edit a previously added mask, click the mask in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

          If you want to remove a mask from the list, point to the mask in the list and click the icon. To clear the list, click Delete all.

          You can copy all masks added to the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Regexp

          To add a regular expression, click Add, enter your regular expression, then click or press Enter.

          Regular expressions of the PCRE format are supported. We do not recommend entering a regular expression longer than 1000 characters.

          You do not need to prefix the string with "re:".

          If necessary, repeat this step to add more regular expressions.

          To paste regular expressions from the clipboard, click Import, type or paste regular expressions separated by semicolons or new lines, then click Import.

          If you want to edit a previously added regular expression, click the regular expression in the text box, make the necessary changes in edit mode and click . If necessary, use search.

          If you want to remove a regular expression from the list, point to the regular expression in the list and click the icon. To clear the list, click Delete all.

          You can copy all regular expressions in the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Dictionaries

          Select the check boxes next to the dictionaries that contain the set of strings that you want to use.

          If necessary, use the search bar.

          The total number of dictionaries of the Strings type and the number of dictionaries used in the condition is displayed above the search. If not all dictionaries are displayed in the window, you can select the number of items you want to display in the drop-down list in the lower part of the dictionary table.

   • From

     To find messages from specific sender addresses:

     1. Select the criterion that decides that the condition is satisfied:
        • List of senders contains at least one address listed below
        • List of senders does not contain any address listed below
        • Empty list of senders
        • Non-empty list of senders
     2. If you select the List of senders contains at least one address listed below or List of senders does not contain any address listed below criterion, under Search text, enter sender addresses that you want to look for in messages.

        You can specify the addresses in the following ways:

        • Text

          To add some text, click Add, enter your text, then click or press ENTER. If necessary, repeat this step to add more strings.

          To paste text from the clipboard, click Import, type or paste text strings separated by semicolons or new lines, then click Import.

          If you want to edit a previously text string, click it in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

          If you want to remove a string from the list, point to the header in the list and click the icon. To clear the list, click Delete all.

          We do not recommend entering a string longer than 1000 characters.

          You can copy all text strings in the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Wildcard

          To add a search mask, click Add, enter your text, then click or press Enter. If necessary, repeat this step to add more masks.

          We do not recommend entering a mask longer than 1000 characters.

          To paste masks from the clipboard, click Import, type or paste search masks separated by semicolons or new lines, then click Import.

          If you want to edit a previously added mask, click the mask in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

          If you want to remove a mask from the list, point to the mask in the list and click the icon. To clear the list, click Delete all.

          You can copy all masks added to the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Regexp

          To add a regular expression, click Add, enter your regular expression, then click or press ENTER.

          Regular expressions of the PCRE format are supported. The search is performed in multi-line mode.

          Examples

          When searching in the body of the message using a regular expression of the ^test_pattern$ form, the condition is triggered for messages whose body consists of only the test_pattern string (no leading or trailing spaces), as well as for messages whose body contains at least one string consisting only of test_pattern (no leading or trailing spaces).

          If the condition must be triggered only for messages whose entire body consists of only the test_pattern string (without leading or trailing spaces), use the \Atest_pattern\z regular expression.

          You do not need to prefix the string with "re:".

          If necessary, repeat this step to add more regular expressions.

          To paste regular expressions from the clipboard, click Import, type or paste regular expressions separated by semicolons or new lines, then click Import.

          If you want to edit a previously added regular expression, click the regular expression in the text box, make the necessary changes in edit mode and click . If necessary, use search.

          If you want to remove a regular expression from the list, point to the regular expression in the list and click the icon. To clear the list, click Delete all.

          We do not recommend entering a regular expression longer than 1000 characters.

          You can copy all regular expressions in the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Dictionaries

          Select the check boxes next to the dictionaries that contain the set of strings that you want to use.

          If necessary, use the search bar.

          The total number of dictionaries of the Strings type and the number of dictionaries used in the condition is displayed above the search. If not all dictionaries are displayed in the window, you can select the number of items you want to display in the drop-down list in the lower part of the dictionary table.

     All values specified on the tabs are combined into a list of search strings. The sender address in the scanned message is checked for an exact match (case-insensitive) against each search string.

   • To

     To find messages with specific recipient addresses:

     1. Select the criterion that decides that the condition is satisfied:
        • List of recipients contains at least one address listed below
        • List of recipients does not contain any address listed below
        • Empty list of recipients
        • Non-empty list of recipients
     2. If you select the List of recipients contains at least one address listed below or List of recipients does not contain any address listed below criterion, under Search text, enter recipient addresses that you want to look for in messages.

        You can specify the addresses in the following ways:

        • Text

          To add some text, click Add, enter your text, then click or press ENTER. If necessary, repeat this step to add more strings.

          To paste text from the clipboard, click Import, type or paste text strings separated by semicolons or new lines, then click Import.

          If you want to edit a previously text string, click it in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

          If you want to remove a string from the list, point to the header in the list and click the icon. To clear the list, click Delete all.

          We do not recommend entering a string longer than 1000 characters.

          You can copy all text strings in the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Wildcard

          To add a search mask, click Add, enter your text, then click or press Enter. If necessary, repeat this step to add more masks.

          We do not recommend entering a mask longer than 1000 characters.

          To paste masks from the clipboard, click Import, type or paste search masks separated by semicolons or new lines, then click Import.

          If you want to edit a previously added mask, click the mask in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

          If you want to remove a mask from the list, point to the mask in the list and click the icon. To clear the list, click Delete all.

          You can copy all masks added to the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Regexp

          To add a regular expression, click Add, enter your regular expression, then click or press ENTER.

          Regular expressions of the PCRE format are supported. The search is performed in multi-line mode.

          Examples

          When searching in the body of the message using a regular expression of the ^test_pattern$ form, the condition is triggered for messages whose body consists of only the test_pattern string (no leading or trailing spaces), as well as for messages whose body contains at least one string consisting only of test_pattern (no leading or trailing spaces).

          If the condition must be triggered only for messages whose entire body consists of only the test_pattern string (without leading or trailing spaces), use the \Atest_pattern\z regular expression.

          You do not need to prefix the string with "re:".

          If necessary, repeat this step to add more regular expressions.

          To paste regular expressions from the clipboard, click Import, type or paste regular expressions separated by semicolons or new lines, then click Import.

          If you want to edit a previously added regular expression, click the regular expression in the text box, make the necessary changes in edit mode and click . If necessary, use search.

          If you want to remove a regular expression from the list, point to the regular expression in the list and click the icon. To clear the list, click Delete all.

          We do not recommend entering a regular expression longer than 1000 characters.

          You can copy all regular expressions in the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Dictionaries

          Select the check boxes next to the dictionaries that contain the set of strings that you want to use.

          If necessary, use the search bar.

          The total number of dictionaries of the Strings type and the number of dictionaries used in the condition is displayed above the search. If not all dictionaries are displayed in the window, you can select the number of items you want to display in the drop-down list in the lower part of the dictionary table.

     All values specified on the tabs are combined into a list of search strings. Each recipient address in the scanned message is checked for an exact match (case-insensitive) against each search string.

   • CC

     To find messages with specific CC recipient addresses:

     1. Select the criterion that decides that the condition is satisfied:
        • List of CC recipients contains at least one address listed below
        • List of CC recipients does not contain any address listed below
        • Empty list of CC recipients
        • Non-empty list of CC recipients
     2. If you select the List of CC recipients contains at least one address listed below or List of CC recipients does not contain any address listed below criterion, under Search text, enter recipient addresses that you want to look for in messages.

        You can specify the addresses in the following ways:

        • Text

          To add some text, click Add, enter your text, then click or press ENTER. If necessary, repeat this step to add more strings.

          To paste text from the clipboard, click Import, type or paste text strings separated by semicolons or new lines, then click Import.

          If you want to edit a previously text string, click it in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

          If you want to remove a string from the list, point to the header in the list and click the icon. To clear the list, click Delete all.

          We do not recommend entering a string longer than 1000 characters.

          You can copy all text strings in the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Wildcard

          To add a search mask, click Add, enter your text, then click or press Enter. If necessary, repeat this step to add more masks.

          We do not recommend entering a mask longer than 1000 characters.

          To paste masks from the clipboard, click Import, type or paste search masks separated by semicolons or new lines, then click Import.

          If you want to edit a previously added mask, click the mask in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

          If you want to remove a mask from the list, point to the mask in the list and click the icon. To clear the list, click Delete all.

          You can copy all masks added to the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Regexp

          To add a regular expression, click Add, enter your regular expression, then click or press ENTER.

          Regular expressions of the PCRE format are supported. The search is performed in multi-line mode.

          Examples

          When searching in the body of the message using a regular expression of the ^test_pattern$ form, the condition is triggered for messages whose body consists of only the test_pattern string (no leading or trailing spaces), as well as for messages whose body contains at least one string consisting only of test_pattern (no leading or trailing spaces).

          If the condition must be triggered only for messages whose entire body consists of only the test_pattern string (without leading or trailing spaces), use the \Atest_pattern\z regular expression.

          You do not need to prefix the string with "re:".

          If necessary, repeat this step to add more regular expressions.

          To paste regular expressions from the clipboard, click Import, type or paste regular expressions separated by semicolons or new lines, then click Import.

          If you want to edit a previously added regular expression, click the regular expression in the text box, make the necessary changes in edit mode and click . If necessary, use search.

          If you want to remove a regular expression from the list, point to the regular expression in the list and click the icon. To clear the list, click Delete all.

          We do not recommend entering a regular expression longer than 1000 characters.

          You can copy all regular expressions in the list. To do so, click Copy all.

          If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

        • Dictionaries

          Select the check boxes next to the dictionaries that contain the set of strings that you want to use.

          If necessary, use the search bar.

          The total number of dictionaries of the Strings type and the number of dictionaries used in the condition is displayed above the search. If not all dictionaries are displayed in the window, you can select the number of items you want to display in the drop-down list in the lower part of the dictionary table.

     All values specified on the tabs are combined into a list of search strings. Each CC recipient address in the scanned message is checked for an exact match (case-insensitive) against each search string.

   Expression with a logical connection of the Only if all conditions match type and conditions for Attachment name and Attachment type attributes are triggered only if the message contains at least one attachment that satisfies all the conditions for attachments.

   Example of an expression triggering with name and attachment format conditions.

   For example, consider an expression with a logical connection of the Only if all conditions match type, in which the following conditions are specified:

   1. The attachment type matches at least one item from the list: DOCX, ODT.
   2. The attachment name contains at least one item from the list: "Taxpayer summons notification", "Tax agent summons notification".

   This expression is triggered if at least one of the following attachments is found in the message:

   • Taxpayer summons notification.DOCX
   • Taxpayer summons notification.ODT
   • Tax agent summons notification.DOCX
   • Tax agent summons notification.ODT

   If the expression contains conditions for other message attributes, such an expression is triggered if the following requirements are satisfied:

   1. The message contains at least one attachment that satisfies all attachment conditions.
   2. All other conditions are triggered.

   An expression with the Only if all conditions match logical connection type, conditions for the MIME part size attribute, and conditions for the Attachment type or Attachment name attribute triggers only if the message contains at least one attachment that simultaneously satisfies all conditions for attachments and MIME part size. More details

   If the condition with the Only if all conditions match logical connection type contains at least one MIME part size condition and at least one attachment type or attachment size condition, the expression is evaluated as follows:

   1. If an attachment type condition exists, a search for matching attachments is performed.

      If the condition has the Scan compound objects or Check file types in archives check box selected, attachments containing elements of the types specified in the condition are also considered matches.

   2. If an attachment name condition exists, a search for matching attachments is performed.

      If the condition has the Scan compound objects or Check file names in archives check box selected, attachments containing elements with names specified in the condition are also considered matches.

   3. A search is performed for MIME parts that satisfy the MIME part size condition.
   4. A search is performed for attachments that simultaneously satisfy conditions 1 through 3.
   5. Searching for a match for other attributes, if any.

   The expression is triggered in the following cases:

   • If the expression had no conditions for attributes other than MIME part size, attachment type, or attachment name, and attachments were found that satisfied all of those conditions.
   • If the expression had other conditions, attachments must be found that satisfy the MIME part size, type, and/or attachment name conditions, and the conditions for the other attributes must also be satisfied.

   In a condition with the If one or more conditions match logical connection type, the expression is triggered if at least one condition is satisfied for any MIME part, compound object, or archive.

8. Click OK.

The Content Filtering expression condition is created.

Page top