UTM Mail Expression Block/Quarantine Difference?

Hello Silvio F,

Thank you for reaching out to the community, please refer the following article below:
Sophos UTM: Regular expressions for defining mail expression patterns: https://support.sophos.com/support/s/article/KB-000034484?language=en_US

Hi Vivek,

I know this KB, and this is precisely why I’m asking.

This document explains how to use Perl compatible regular expressions in the expression filter of Sophos UTM's Email Protection feature. You can use these expressions to detect emails with inappropriate content. Emails that contain content that matches the regular expression can be blocked or quarantined.

To quarantine mails based on expressions is working, but how am I able to block/reject this Kind of e-mails. 

Regards 

Silvio

Hi Vivek,

I know this KB, and this is precisely why I’m asking.

This document explains how to use Perl compatible regular expressions in the expression filter of Sophos UTM's Email Protection feature. You can use these expressions to detect emails with inappropriate content. Emails that contain content that matches the regular expression can be blocked or quarantined.

To quarantine mails based on expressions is working, but how am I able to block/reject this Kind of e-mails. 

Regards 

Silvio

 Suspicious emails will be blocked

Sorry but this doesn't answer my question. What classifies an e-mail as suspicious when an expressions matches?

Is there a way to select how the UTM handles mails when an expression matches? I can´t find an option. The only thing I can see is in the mailmanager when an e-mail was quarantined based of Reason: "Expression match"

Hallo Silvio,

There is no way to block an email based on an expression match.  Outright blocks can only be accomplished based on the blacklist.

Cheers - Bob

Hi Bob,

Thanks, but then this KB Article is a bit misleading. One of my customers asked exactly this question after he read this KB article. 

Thanks 

Silvio