Hexamail Guard Administration Guide - Blocking - Content

Content

Content

   Content Checks

Block on size
Email over the specified size will be blocked
Example interface
Off, Block
Off
if greater than
The blocker will block any email greater than this size. The size includes any attachments.
Example interface
1 - 256000 Kbytes
1024 Kbytes
Max size to check
The blocker can be set to only check email less than a certain size. This setting can be used to make processing more efficient. Larger email are allowed through the blocker unchecked.
Example interface
10000 Kbytes
Check up to
The blocker can be set to only check up to this amount of an email. This setting can be used to make processing more efficient. Any content phrases matches must appear within this amount of content from the start of the email to be found.
Example interface
32 Kbytes
Content
This list allows the configuration of subject matching expressions. When an expression matches it will perform the action specified for the expression. The expression type shows the type of expression the expression matching engine will use for the entered expression.
Expression types:
Case insensitive substring
simply "match" or "sub(match)"
sub(mail) matches the phrase "Hexamail produces server software"
Case sensitive substring
"SUB(match)"
SUB(mail) does not match the phrase "HexaMail produces server software"
Case insensitive exact match
"cmp(match)"
cmp(mail) matches ONLY the entire exact string "mAil"
Case sensitive exact match
"CMP(match)"
CMP(mail) matches ONLY the entire exact string "mail"
Case insensitive word match
" match " or "word(match)"
word(mail) does not match the phrase "Hexamail produces server software" but does match the phrase "Hexamail produces mail server software"
Case sensitive word match
"WORD(match)"
WORD(Mail) does not match the phrase "Hexamail produces mail server software" but does match the phrase "Mail server software produced by Hexamail"
Case insensitive wild match
"*m?tch*" or "wild(*m?tch*)" (? - single character match, * - multiple character match)
Example wild(*v?agra*) matches the phrase "Hexamail does not ship v1agra"
the * wrappers round wildcard expressions, you can also do wild(Start*) to match the phrase "Start of the content" but not match "the content starts here"
Case sensitive wild match
"WILD(m?tch)"
WILD(*v?agra*) does not match the phrase "Hexamail does not ship V1agra"
the * wrappers round wildcard expressions, you can also do WILD(*End) to match the phrase "The content End" but not match "the content ends here"
Regular expression
"reg(expression)"
can be found at the website
http://www.regular-expressions.info/
Case sensitive regular expression
"REG(expression)"
can be found at the website
http://www.regular-expressions.info/
Boolean expression
"BOOL(expression)"
BOOL(wild(*viagra*) AND wild(*ph?rm?cy*) must match both wild matches to be considered an overall match. Brackets may be used.
Brackets allow nested clauses in a BOOL expression

Add #NN to any weighting expression to multiple the weight by the number NN

 - If matched these expressions allow the email
 - The email MUST have one of these expressions
 - If matched these expressions block the email
(Click the heading to sort by the column)
Expression
The expression
Action
Action the expression has
Type
Type of expression
(Underneath control)
Add an expression
Edit the selected expression
Delete the selected expression(s)
Import expressions from a file using the current action
Export the selected expressions to a file
(Right click selected items)
Expressions file
Expressions can be loaded from a file for us in content matching. Specify the list of expressions and then the action type for the expressions on each line of a CSV file. The actions are Block, Allow, MustHave. See example for more information
Example interface
*Match*,*product ID*,Block *Other*,*another*,Allow *_outbound_*,Musthave

   Attachments

Attachments
Attachments to the email that match the extensions defined
Example interface
Off+Block+Detach
Off
With extensions
Wild cards for identifying attachments to be blocked, by blocking attachments with the default extensions you can help slow the spread of virus and worms
Example interface
*.scr,*.bat,*.com,*.js,*.vbs,*.pif,*.exe,*.jar,*.adp,*.app,*.asp,*.bas,*.bat,*.ce,*.cmd,*.cnt,*.com,*.cpl,*.crt,*.csh,*.de,*.exe,*.fxp,*.gadget,*.hlp,*.hpj,*.hta,*.inf,*.ins,*.isp,*.its,*.js,*.jse,*.ksh,*.lnk,*.mad,*.maf,*.mag,*.mam,*.maq,*.ma,*.mas,*.mat,*.mau,*.mav,*.maw,*.mda,*.mdb,*.mde,*.mdt,*.mdw,*.mdz,*.msc,*.msh,*.msh1,*.msh2,*.mshxml,*.msh1xml,*.msh2xml,*.msi,*.msp,*.mst,*.ops,*.osd,*.pcd,*.pif,*.plg,*.prf,*.prg,*.pst,*.reg,*.scf,*.sc,*.sct,*.shb,*.shs,*.ps1,*.ps1xml,*.ps2,*.ps2xml,*.psc1,*.psc2,*.tmp,*.url,*.vb,*.vbe,*.vbp,*.vbs,*.vsmacros,*.vsw,*.ws,*.wsc,*.wsf,*.wsh,*.xnk,*.ade,*.cla,*.class,*.grp,*.ja,*.mcf,*.ocx,*.pl,*.xbap,
Importing data

Press the import button, also shown as >> when the interface is small, to import data into the list.The following file types are supported:

        CSV (Comma delimited) (*.csv)
        Text (Tab delimited) (*.txt)
        All Files (*.*)
        
The data should be separated by commas, tab characters or newlines.
Each data entry must match the validation wildcard '*.*'. Entries that do not match will be discarded.
Duplicate entries are not imported more than once.
With names
Wild cards for identifying attachment names to be blocked
Example interface
malware*.doc,IMG_*.pdf
Importing data

Press the import button, also shown as >> when the interface is small, to import data into the list.The following file types are supported:

        CSV (Comma delimited) (*.csv)
        Text (Tab delimited) (*.txt)
        All Files (*.*)
        
The data should be separated by commas, tab characters or newlines.
Each data entry must match the validation wildcard '*.*'. Entries that do not match will be discarded.
Duplicate entries are not imported more than once.
Block files within compressed archives
Block files within compressed archives
Example interface
false
true