How can I specify a keyword expression to represent a blank header for matching fields such as "From", "To", or "Subject" when creating rules with the content filter? Parent topic

If you are going to use a regular keyword expression to represent a blank header, Trend Micro recommends that you use "^(\s)*$" (without the quotation marks). The expression "^(\s)*$" (without the quotation marks) represents a blank header or whitespace characters.
For example, if you want to check if a message’s From header is blank, edit a rule’s scanning condition as follows:

Procedure

  1. Go to Policy → Policy List.
  2. Click the link for an existing rule to edit the rule.
  3. Click And scanning conditions match.
  4. Click Header keyword expressions under the Content section.
  5. Click Add to create a new keyword expression.
  6. Add the content as "^(\s)*$”" (without the quotation marks).