Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 4 subscribers
  • Views 7624 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Filtering rules

Julia Hammett

Does anyone know if there is a way of creating a filter in Puremessage that will block emails which certain words in the subject lines, plus come from *@Hotmail or *@gmail.com or *@outlook.com  .  So, for instance - and email with a subject containing 'SEO' and is also from either Hotmail, Gmail or Outlook.

My aim is to stop so many SEO offers coming in, and they are generally not from a company email address, and I don't want to block all mail from those domains.



This thread was automatically locked due to age.
Parents
  • 0

    Hello Julia, 

    Below a suggested rule: 
    Please note you need to adapt it based on your needs: 

    In this rule the following actions are done: 

    • Check if envelope from contains @gmail.com, @outlook.com, @hotmail.com (please note you can also check for header from)
      • If true
        • then check if the subject contains SEO
        • if true
          • then add value into message_log file (here : SEO_DETECTED) and add tag into the subject (here : [SEO DETECTED] )

     

     

    Finally, the PMX Rule: 

    # attr NAME=Security Rules - SEO detection
        if anyof(envelope :comparator "i;ascii-casemap" :all :contains ["from"]
                          ["@gmail.com"],
                 envelope :comparator "i;ascii-casemap" :all :contains ["from"]
                          ["@outlook.com"],
                 envelope :comparator "i;ascii-casemap" :all :contains ["from"]
                          ["@hotmail.com"])
        {
            pmx_mark1 "External_IPBlock";
            # attr NAME=Security Rules - SEO detection in subject
            if header :comparator "i;ascii-casemap" :contains ["Subject"] ["SEO"] {

                   pmx_mark1 "SEO_DETECTED";
                   pmx_replace_header :index 0 "Subject" "[SEO DETECTED] %%SUBJECT:h_utf8%%";
            }
        }

    I Hope this information help you.

    Best regards, 

    --

    Best regards,
    Florian (aka LEFBE)
    Sophos Technical Account Manager

Reply
  • 0

    Hello Julia, 

    Below a suggested rule: 
    Please note you need to adapt it based on your needs: 

    In this rule the following actions are done: 

    • Check if envelope from contains @gmail.com, @outlook.com, @hotmail.com (please note you can also check for header from)
      • If true
        • then check if the subject contains SEO
        • if true
          • then add value into message_log file (here : SEO_DETECTED) and add tag into the subject (here : [SEO DETECTED] )

     

     

    Finally, the PMX Rule: 

    # attr NAME=Security Rules - SEO detection
        if anyof(envelope :comparator "i;ascii-casemap" :all :contains ["from"]
                          ["@gmail.com"],
                 envelope :comparator "i;ascii-casemap" :all :contains ["from"]
                          ["@outlook.com"],
                 envelope :comparator "i;ascii-casemap" :all :contains ["from"]
                          ["@hotmail.com"])
        {
            pmx_mark1 "External_IPBlock";
            # attr NAME=Security Rules - SEO detection in subject
            if header :comparator "i;ascii-casemap" :contains ["Subject"] ["SEO"] {

                   pmx_mark1 "SEO_DETECTED";
                   pmx_replace_header :index 0 "Subject" "[SEO DETECTED] %%SUBJECT:h_utf8%%";
            }
        }

    I Hope this information help you.

    Best regards, 

    --

    Best regards,
    Florian (aka LEFBE)
    Sophos Technical Account Manager

Children
No Data
Unfiltered HTML