Configuring Content Filtering Criteria

On the Scanning Criteria tab, select Advanced to display the advanced criteria.

From the drop-down list, do one of the following:

Select "All Match" to trigger the rule only when all selected "Advanced" criteria are matched.
Select "Any Match" to do the following:
- Trigger the rule when any selected "Advanced" criteria are matched
- Display the Attachment is "password protected", Attachment contains "active content", and Recipient number criteria in the "Advanced" criteria list

The following tables all contain the same information sorted differently. Use the following sorted tables to find appropriate "Advanced" criteria to filter messages by your desired rule targets:

Table 1. Advanced Criteria Sorted by Display Order
Rule Targets	Criteria		Filter Based On
Sorted by display order	Envelope sender is	"blank"	Envelope sender
	Message header sender differs from	"envelope sender"	Message header sender and envelope sender
	Message header sender differs from	"header Reply-To"	Message header sender and message header Reply-To
	Specified header matches	" keyword expressions "	Keywords in headers and content
	Message size is	>, <= <number> KB, MB	Size
	Subject matches	" keyword expressions "	Keywords in headers and content
	Subject is	" blank "
	Body matches	" keyword expressions "
	Body is	"blank"
	Attachment is	" file name or extension "	Attachment file name or extension
		" MIME content type "	Attachment MIME content type
		" true file type "	Attachment true file type Note: For Microsoft Office files of version 2007 or later, Trend Micro Email Security supports attachment true file type detection only when the files are not encrypted.
	Attachment content matches	" keyword expressions "	Keywords in headers and content
	Attachment size is	>, <= <number> B, KB, MB	Attachment size
	Attachment number is	>, <= <number>	Number of attachments
	Attachment is	" password protected "	Zipped, signed, or password-protected attachment
	Attachment contains	" active content "	Active content in Microsoft Word, Excel and PowerPoint attachments
	Recipient number	>, <= <number>	Number of recipients

Table 2. Advanced Criteria Sorted by Attribute and Content Targets
Rule Targets	Criteria		Filter Based On
Envelope sender and message header sender	Envelope sender is	"blank"	Envelope sender
	Message header sender differs from	"envelope sender"	Message header sender and envelope sender
	Message header sender differs from	"header Reply-To"	Message header sender and message header Reply-To
Name and type attributes	Attachment is	" file name or extension "	Attachment file name or extension
		" MIME content type "	Attachment MIME content type
		" true file type "	Attachment true file type Note: For Microsoft Office files of version 2007 or later, Trend Micro Email Security supports attachment true file type detection only when the files are not encrypted.
Size attributes	Message size is	>, <= <number> KB, MB	Size
Size attributes	Attachment size is	>, <= <number> B, KB, MB	Attachment size
Keyword content	Subject matches	" keyword expressions "	Keywords in headers and content
	Subject is	" blank "
	Body matches	" keyword expressions "
	Body is	"blank"
	Specified header matches	" keyword expressions "
	Attachment content matches	" keyword expressions "
Active content	Attachment contains	" active content "	Active content in Microsoft Word, Excel and PowerPoint attachments
Quantity attributes	Attachment number is	>, <= <number>	Number of attachments
Quantity attributes	Recipient number	>, <= <number>	Number of recipients
Compressed, signed, or encrypted attributes	Attachment is	" password protected "	Zipped, signed, or password-protected attachment

Table 3. Advanced Criteria Sorted by Message-Only or Attachment-Only Targets
Rule Targets	Criteria		Filter Based On
Message-only	Envelope sender is	"blank"	Envelope sender
	Message header sender differs from	"envelope sender"	Message header sender and envelope sender
	Message header sender differs from	"header Reply-To"	Message header sender and message header Reply-To
	Message size is	>, <= <number> KB, MB	Size
	Subject matches	" keyword expressions "	Keywords in headers and content
	Subject is	" blank "
	Body matches	" keyword expressions "
	Body is	"blank"
	Specified header matches	" keyword expressions "
	Recipient number	>, <= <number>	Number of recipients
Attachment-only	Attachment is	" file name or extension "	Attachment file name or extension
		" MIME content type "	Attachment MIME content type
		" true file type "	Attachment true file type Note: For Microsoft Office files of version 2007 or later, Trend Micro Email Security supports attachment true file type detection only when the files are not encrypted.
	Attachment content matches	" keyword expressions "	Keywords in headers and content
	Attachment size is	>, <= <number> B, KB, MB	Attachment size
	Attachment number is	>, <= <number>	Number of attachments
	Attachment is	" password protected "	Zipped, signed, or password-protected attachment
	Attachment contains	" active content "	Active content in Microsoft Word, Excel and PowerPoint attachments