Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Creating a content filtering rule for filtering mails by a specific header in Deep Discovery Email Inspector (DDEI)

    • Updated:
    • 26 Mar 2019
    • Product/Version:
    • Deep Discovery Email Inspector 3.0
    • Deep Discovery Email Inspector 3.1
    • Deep Discovery Email Inspector 3.2
    • Platform:
    • N/A N/A
Summary

This article explains how to create a content filtering rule to filter mails by specific header(s).

Details
Public
  1. Access the DDEI WebUI.
  2. Go to Policies > Policy Management > Content Filtering Rules then click + Add.

    Policy Management page

  3. The Add Content Filtering Rule page shows up. Provide a rule name.

    In this example, let's use Delete mails based on From address as the Rule name.

    provide a rule name

  4. Under the Scanning Criteria/Content section, click + Add.

    Click add under Content section

  5. In the Message section field, choose Header. Leave "Match case" and "Match whole word only" unselected then input the keywords in <Header Name>:<keyword> format. Press the Enter key after each keyword as shown in the following:

    Add keywords

    Click Save.

    HINTS:

    • The left side of “:” will be used to do full match of a header name.
    • the right side of “:” will be matched against the header content line.
    • The “:” itself will NOT be used for matching.
    • The filter in the above sample can be used as a solution to filter out spoofed internal messages, by setting the policy Recipients to internal recipients (*@internal.domain)
  6. From the Action field dropdown list, select the appropriate action then click Save to save the rule.

    Choose action

  7. Open an existing policy or create a new policy if the rule is supposed to apply only to certain users.

    In this example, click on the Policy Name of an existing policy which is Default Policy.

    Open a policy or create a new one

    The Edit Policy page appears.

  8. Go to the Content Filtering tab and click None to view the dropdown list. Select the Content Filtering rule you just created.

    In this example, the name of the created rule is Delete mails based on From address

    Content Filtering tab

    Click Add.

    Click Add

  9. Click Save to save the changes.

    Click Save

Premium
Internal
Rating:
Category:
Configure
Solution Id:
1122302
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.