config_expression
Configure keyword and regular expressions to enable IMSVA to scan email message content. You can create keywords or expressions from the Keywords & Expressions screen or during rule creation.
While keywords or expressions can be created during policy creation, Trend Micro recommends creating keywords or expressions before you begin creating policies.
To create keywords or expressions:
Click Policy > Keywords & Expressions. The Keywords & Expressions screen appears.
Click Add. The Add Keyword Expression screen appears.
Next to List name, type a descriptive name.
Next to Match, select one of the following that specifies when IMSVA takes action:
Any specified: Email message content can match any of the expressions in the list.
All specified: Email message content must match all the expressions in the list.
Not the specified: Email message content must not match any of the expressions in the list.
Only when combined score exceeds threshold: Next to Total message score to trigger action, type a number that represents the maximum score for allowed keyword expressions. When you add an expression, you can set a value for the Score.
To create an expression, click Add. The Add Keyword Expression list appears.
Type the keywords. For a partial match, type the keyword. To specify an exact match, use "\s" (without the quotes) before and after the keyword.
For example:
keyword matches "keywords", "akeyword", and so on.
\skeyword\s matches "keyword" only.
Click Save. The Add Keyword Expression list appears.
To instruct IMSVA to consider the capitalization of email content when it uses the filter, select the check box under Case sensitive.
If you selected Only when combined score exceeds threshold:
Specify a threshold in the Total message score to trigger action field.
Select a value from the Score drop-down box.
Click Save. The Keywords & Expressions screen appears with the new keyword or expression appearing in the table.
To add or edit a keyword or expression during policy creation or modification:
Create or modify an "Other" (not an Antivirus) policy.
For information on creating a new rule, see Adding Policies.
For information on modifying an existing rule, see Modifying Existing Policies.
Under Content on the Scanning Conditions screen, click the link that specifies the part of the email message to which you want to configure content conditions. The Keyword Expressions screen appears with two columns:
Click Add or Edit from the Keyword Expressions screen. The configuration screen for keyword expression lists appears.
Next to List name, type a descriptive name.
Next to Match, select one of the following that specifies when IMSVA takes action:
Any specified: Email message content can match any of the expressions in the list.
All specified: Email message content must match all the expressions in the list.
Not the specified: Email message content must not match any of the expressions in the list.
Only when combined score exceeds threshold: Next to Total message score to trigger action, type a number that represents the maximum score for allowed keyword expressions. When you add an expression, you can set a value for the Score.
To create an expression, click Add. The Add Keyword Expression list appears.
Type the keywords. For a partial match, just type the keyword. To specify an exact match, use "\s" (without the quotes) before and after the keyword.
For example:
keyword matches "keywords", "akeyword", etc.
\skeyword\s matches "keyword" only.
If you selected Only when combined score exceeds threshold:
Specify a threshold in the Total message score to trigger action field.
Select a value from the Score drop-down box.
Click Save. The configuration screen for keyword expression lists reappears with the expression in the list.
To instruct IMSVA to consider the capitalization of email content when it uses the filter, select the check box under Case sensitive.
Click Save to continue modifying or creating the policy.
See also: