Views:
Expressions are words or phrases ScanMail uses to filter message content based on headers and actual content.
When creating or modifying content filter expressions, refer to the help section at the bottom of the New Expression workspace for details on how to use logical operators.
Leave a space before and after each operand in the expression. Do not insert line breaks or carriage returns within a single expression. Create two expressions, instead.
For example, to create an expression to distinguish between "apple" fruit and "apple" computer, you may want to construct a rule such as the following:
.(. .OCCUR. apple .). .AND. .(. apple .NEAR. computer .). .OR. .(. apple .NEAR. macintosh .). .AND. .(. .NOT. .(. .OCCUR. eat .). .).
This rule triggers a match if:
  • The word Apple occurs two or more times in a document, and within 25 words in either direction of the word computer
  • The word Macintosh occurs in a document
However, if the word eat also occurs in the document—a match is not triggered.
Trend Micro recommends keeping expressions simple and narrowly defined. Instead of one complex rule as shown above, create two simpler expressions and attach each to a mail scan rule.
Expression 1: .(. .OCCUR. apple .). .AND. .(. apple .NEAR. computer .).
Expression 2: .(. apple .NEAR. macintosh .). .AND. .(. .NOT. .(. .OCCUR. eat .). .).
When you configure multiple expressions to a mail scan rule, the OR operator is used between them.
To create expressions, see Create New Expressions.
Keywords: expressions