Trend Micro InterScan™ Messaging Security Suite Online Help

Collapse AllExpand All
  • about IMSS [1]
  • activate
  • add
    • administrator accounts [1]
  • address group
  • address groups
    • examples of [1]
    • understand [1]
  • administrator accounts
  • Advanced Threat Scan Engine [1]
  • adware [1]
  • antivirus rule [1]
  • APOP [1]
  • approved list
    • add hosts [1]
  • approved senders list
    • configure [1]
  • archive
    • configure settings [1]
  • archive areas
  • archived messages
  • asterisk wildcard
  • attachment size
    • scanning conditions [1]
  • audience [1]
  • back up
  • blocked list
    • add records [1]
  • blocked senders list
    • configure [1]
  • bounced mail settings
    • configure [1]
  • change
    • management console password [1]
  • Cloud Pre-Filter
    • configure DNS MX records [1]
    • create account [1]
    • create policy [1]
    • policies [1]
    • suggested settings [1]
    • troubleshoot [1]
    • understand [1]
    • verify it works [1]
  • Cloud Pre-Filter tab [1]
  • Command & Control (C&C) Contact Alert Services [1]
  • commands [1]
  • community [1]
  • component update [1]
  • condition statements [1]
  • Configuration Wizard
    • accessing [1]
  • configure
    • approved senders list [1]
    • archive settings [1]
    • blocked senders list [1]
    • connection settings [1] [2]
    • Control Manager server settings [1]
    • database maintenance schedule [1]
    • delivery settings [1]
    • Direct Harvest Attack (DHA) settings [1]
    • DNS MX records [1]
    • Email reputation [1]
    • encrypted message scan actions [1]
    • expressions [1]
    • internal addresses [1] [2]
    • LDAP settings [1]
    • log settings [1]
    • Messaged Delivery settings [1]
    • Message Rule settings [1]
    • notification messages [1]
    • notification settings [1]
    • other scanning exceptions scan actions [1] [2]
    • POP3 settings [1] [2]
    • product settings [1]
    • quarantine settings [1]
    • route [1]
    • scan exceptions [1]
    • scheduled reports [1]
    • security setting violation exceptions [1] [2]
    • security setting violation scan actions [1]
    • Sender Filtering [1]
    • Sender Filtering bounced mail settings [1]
    • Sender Filtering spam settings [1]
    • Sender Filtering virus settings [1]
    • SMTP routing [1]
    • SMTP settings [1]
    • spam text exemption rules [1]
    • TMCM settings [1]
    • update source [1]
    • Web EUQ Digest settings [1]
  • configure event criteria [1]
  • configuring
    • Encryption settings [1]
  • connection settings
  • Control Manager
    • enable agent [1]
    • replicate settings [1]
    • see Trend Micro Control Manager [1]
  • Control Manager server settings
    • configure [1]
  • Conventional scan [1]
  • criteria
    • customized expressions [1]
    • keywords [1]
  • customized expressions [1] [2] [3]
  • customized keywords [1]
  • customized templates [1]
  • dashboard
  • database
    • configure maintenance schedule [1]
  • data identifiers [1]
    • expressions [1]
    • file attributes [1]
    • keywords [1]
  • Data Loss Prevention [1]
  • Data Loss Prevention (DLP) [1]
  • default tabs [1]
  • delete
    • address group [1]
    • administrator accounts [1]
  • delivery settings
    • configure [1]
  • dialers [1]
  • Direct Harvest Attack (DHA) settings
    • configure [1]
  • display
    • domains [1]
    • suspicious IP addresses [1]
  • DLP [1]
  • documentation [1]
  • domains
  • edit
    • address group [1]
    • administrator accounts [1]
  • Email Encryption
    • managing domains [1]
    • registering domains [1]
    • understand [1]
  • email relay [1]
  • Email reputation [1]
  • email threats
    • spam [1]
    • unproductive messages [1]
  • enable
    • Control Manager agent [1]
    • Email reputation [1]
    • End-User Access [1]
    • EUQ [1]
    • IP Profiler [1]
    • POP3 scanning [1]
    • sender filtering rules [1]
  • encrypting messages [1]
  • Encryption settings
    • configuring [1]
  • End-User Access
  • ERS
  • EUQ [1]
    • authentication [1]
    • disable [1]
    • enable [1]
    • open the console [1]
    • start [1]
    • web console [1]
    • Web console [1]
  • event criteria
    • configure [1]
  • event notifications [1]
  • export notes [1]
  • expression lists
  • expressions [1] [2]
  • FAQ
  • file attributes [1] [2] [3] [4]
  • File Reputation Services [1] [2]
  • filtering, how it works [1]
  • filters
    • examples of [1]
  • generate
  • graymail [1]
  • hacking tools [1]
  • import notes [1]
  • IMSA
  • IMSS
  • internal addresses
  • IP Profiler [1]
  • joke program [1]
  • keywords [1] [2]
  • known hosts [1]
  • LDAP settings
  • LDAP User or Group
    • search for [1]
  • license
  • logical operators [1]
  • logs [1]
    • configure settings [1]
    • query [1]
    • query message tracking [1]
    • query MTA event [1]
    • query policy event [1]
    • query quarantine event [1]
    • query sender filtering [1]
    • query system event [1]
    • query URL click tracking [1]
  • manage
    • administrator accounts [1]
    • expression lists [1]
    • notifications list [1]
    • one-time reports [1]
    • product licenses [1]
  • manage domains for Email Encryption [1]
  • management console password
  • manual update [1]
  • mass mailing viruses
  • message delivery [1]
  • Message Delivery settings
    • configure [1]
  • Message Rule settings
    • configure [1]
  • messages in the Virtual Analyzer queue
  • message size
    • scanning conditions [1]
  • message traffic tab [1]
  • MIME content type
    • scanning conditions [1]
  • MTA
  • new features [1]
  • notes
  • notification messages
    • configure [1]
  • notifications
  • notification settings
    • configure [1]
  • notifications list
  • one-time reports
  • online
    • community [1]
  • online help [1]
  • other rule [1]
  • password
    • management console [1]
  • password cracking applications [1]
  • pattern files
  • PCRE [1]
  • Perle Compatible Regular Expressions [1]
  • permitted senders [1]
  • policies
  • policy management
  • policy notification
  • POP3 messages
  • POP3 scanning
  • POP3 settings
  • postponed messages
  • predefined expressions [1]
  • predefined keywords
    • distance [1]
    • number of keywords [1]
  • predefined templates [1]
  • product licenses
  • product services [1]
  • product settings
    • configure [1]
  • quarantine
    • configure settings [1]
  • quarantine and archive [1]
  • quarantine areas
  • quarantined messages
  • query
    • archive areas [1]
    • logs [1]
    • messages [1]
    • messages in the Virtual Analyzer queue [1]
    • MTA event logs [1]
    • policy event logs [1]
    • postponed messages [1]
    • quarantine areas [1]
    • quarantine event logs [1]
    • sender filtering logs [1]
    • system event logs [1]
    • URL click tracking logs [1]
  • readme file [1]
  • register domains for Email Encryption [1]
  • remote access tools [1]
  • renew
  • replicating settings [1]
  • reports
  • restore
  • roll back
    • components [1]
  • route
  • scan
    • POP3 messages [1]
    • SMTP messages [1]
  • scan actions
    • configure encrypted message settings [1]
    • configure other scanning exceptions settings [1] [2]
  • scan engine
  • scan exceptions
    • configure [1]
  • Scan methods [1]
  • scanning conditions [1]
    • attachment names [1]
    • attachment number [1] [2]
    • attachments [1]
    • attachment size [1]
    • extensions [1]
    • message size [1]
    • MIME content type [1]
    • spam [1]
    • specify [1]
    • true file type [1]
  • scheduled reports
  • scheduled updates [1]
  • security risks
    • spyware/grayware [1]
  • security setting violations
    • configure exceptions [1] [2]
    • configure scan actions [1]
  • Sender Filtering
    • configure [1]
    • configure bounced mail settings [1]
    • configure Direct Harvest Attack (DHA) settings [1]
    • configure spam settings [1]
    • configure virus settings [1]
  • Sender Filtering Service
  • Sender Filtering tab [1]
  • services [1]
    • Sender Filtering Service [1]
  • smart protection [1] [2]
  • Smart Protection [1] [2]
  • Smart Protection Network [1] [2]
  • Smart Scan [1]
  • SMTP
    • notification server [1]
  • SMTP messages
  • SMTP routing [1]
    • configure [1]
  • SMTP settings
    • configure [1]
  • spam settings
    • configure [1]
  • spam text exemption rules
    • configure [1]
  • specify
    • actions [1]
    • route [1]
    • scanning conditions [1]
    • update source [1]
  • spyware/grayware [1]
    • adware [1]
    • dialers [1]
    • entering the network [1]
    • hacking tools [1]
    • joke program [1]
    • password cracking applications [1]
    • remote access tools [1]
    • risks and threats [1]
  • start
  • support
    • knowledge base [1]
    • resolve issues faster [1]
    • TrendLabs [1]
  • suspicious IP addresses
  • system overview tab [1]
  • System Status screen [1]
  • tabs
    • add a tab [1]
    • Cloud Pre-Filter [1]
    • configure a tab [1]
    • default tabs [1]
    • message traffic [1]
    • Sender Filtering [1]
    • system overview [1]
    • understand [1]
  • tag subject
  • templates [1] [2] [3] [4] [5] [6]
  • TMCM settings
    • configure [1]
  • transport layer [1]
  • TrendLabs [1]
  • Trend Micro Control Manager [1]
  • troubleshooting [1]
    • imssps daemon [1]
  • true file type [1]
  • understand
    • Email Encryption [1]
    • widgets [1]
  • update
    • automatically [1]
    • manually [1]
    • pattern files [1]
    • scan engine [1]
    • system and application [1]
  • update source
  • view
    • archived messages [1]
    • messages in the Virtual Analyzer queue [1]
    • postponed messages [1]
    • product licenses [1]
    • quarantined messages [1]
  • Virtual Analyzer [1]
  • virus settings
    • configure [1]
  • Web EUQ Digest
    • configure settings [1]
  • Web Reputation Services [1] [2]
  • what’s new [1]
  • widgets
    • add a widget [1]
    • configure a widget [1]
    • edit a widget [1]
    • understanding [1]
    • using a widget [1]
  • wildcards [1]
    • file attributes [1]

Creating Keywords or Expressions Parent topic

Procedure

  1. Go to Policy → Keywords & Expressions.
    The Keywords & Expressions screen appears.
  2. Click Add.
    The Add Keyword Expression screen appears.
  3. Next to List name, specify a descriptive name.
  4. Next to Match, select one of the following that specifies when IMSS takes action:
    • Any specified: Message content matches any of the keywords or expressions in the list.
    • All specified: Message content matches all keywords or expressions in the list.
    • Not the specified: Message content does not match any of the keywords or expressions in the list.
    • Only when combined score exceeds threshold: Message content contains one or more keywords or expressions in the list. If only one keyword or expression was detected, its score must be higher than the threshold. If several keywords or expressions are detected, their combined score must be higher than the threshold.
      Next to Total message score to trigger action, specify a number that represents the maximum score for allowed keyword expressions. When you add an expression, you can set a value for the Score.
  5. To create a new keyword expression, do the following:
    1. Click Add.
      The Add Keyword Expression list appears.
    2. Define the following parameters:
      Keyword
      Specify the keywords. For a partial match, specify the keyword. To specify an exact match, use \b before and after the keyword.
      For example:
      • keyword matches "keywords", "akeyword"
      • \bkeyword\b matches "keyword" only
      Case sensitive
      Make the keyword expression case sensitive.
      Description
      Specify a description for the added keyword expression to make it easier to understand.
    3. Click Save.
  6. If you selected Only when combined score exceeds threshold:
    1. Specify a threshold in the Total message score to trigger action field.
    2. Select a value from the Score drop-down box.
  7. Click Save.
    The Keywords & Expressions screen appears with the new keyword or expression appearing in the table.