Summary
Learn which keyword expression in the policy triggered the rule and blocked the email in InterScan Messaging Security Suite (IMSS) or InterScan Messaging Security Virtual Appliance (IMSVA).
Details
If an email was blocked due to the content, you will not readily see in the logs which keyword expression triggered the action.
To verify the keyword expression, configure a notification for blocked emails:
- On the policy that detected the email, configure the action to send out a notification to the email administrator. The notification should contain “%DETECTED%”.
- Resend the email so it will pass through the IMSS or IMSVA server. When the email is blocked again, you will receive a notification with information on the PERL regular expression that triggered the policy.
