What To Look For? clauses

What To Look For? clauses look for conditions that must be met to trigger a content rule. Content rules can consist of more than one predefined What To Look For? clause. If a content rule contains multiple clauses, a message must meet all the specified conditions, otherwise, the content rule will not be triggered.

This topic contains a brief overview of all the What To Look For? clauses Secure Email Gateway uses in content rules.

What To Look For?

• Always Trigger the Rule

  The Always Trigger the Rule clause specifies that the content rule must always be triggered.

  You cannot edit this clause.

• Analyze Properties

  The Analyze Properties clause is present in the Analyze Properties content rule. The Analyze Properties clause looks for a Document Properties expression list in attached files and documents. These lists match specific string values with specific document properties. See Document Properties for more information.

• Attachments

  The Attachments clause enables you to remove attachments using the Sanitize Message content rule. If you select the Remove Attachments check box, any attachments in detected messages will be removed.

  Attachments applies to the Sanitize Message content rule.

• Bypass Rule

  The Bypass Rule clause enables you to bypass sanitization or redaction on a content rule for any signed document. Sanitization or redaction will not be attempted on signed documents if the Bypass Rule for signed documents check box is selected.

  Bypass Rule applies to the following content rules:

  • Redact Text
  • Sanitize Active Content
  • Sanitize Document Content

  Bypass Rule only affects signed documents. The Gateway will continue to apply unsuccessful redaction to signed messages, even when this check box is selected.

• Classification Level

  The Classification level specifically relates to values that are assigned to items that have been registered on an IG Server.

  The disposal action will trigger where content passing through the Gateway is matched to content registered on the IG Server, and where the Classification level for the item as set on the IG server is equal or exceeds the level set on the Gateway.

  If this value is set to 0 on your Gateway, matches to any IG registered items will trigger the disposal action.

  The Classification Level The Classification Level specifically relates to values that are assigned to items that have been registered on an IG Server. The disposal action will trigger where content passing through the Gateway is matched to content registered on the IG Server, and where the Classification level for the item as set on the IG server is equal or exceeds the level set on the Gateway. If this value is set to 0 on your Gateway, matches to any IG registered items will trigger the disposal action. clause is used in the Check Registered Data content rule template.

• Cryptographic Failure

  The Cryptographic Failure clause looks for instances where encryption or decryption has failed.

  You can configure the clause to trigger:

  • If a message cannot be encrypted

  • If a message cannot be decrypted

  The Cryptographic Failure clause is used in the Encryption or decryption fails content rule template.

• Detect Malformed Data

  The Detect Malformed Data content rule enables you to handle messages that include malformed data. For example, you might want to hold any messages containing a PDF attachment identified as containing malformed data. This enables you to review those messages and then release or reject them at a later time.

  The Detect Malformed Data content rule operates on selected Media Types. You can exclude or include certain types (such as PDF) using a combination of Detect Malformed Data content rules.

• Digital Signature Validation

  The Digital Signature Validation clause looks for digital signatures. You can configure the clause to look for instances where:

  • The transaction Does not have a digital signature A digitally-signed message proves to the recipient that you, not an imposter, signed the contents of the message, and that the contents have not been altered in transit.
  • All the digital signatures are valid
  • At least one digital signature is valid

  • There is an issue with a digital signature.

    You can specify the clause to look for the conditions where the Signature is NOT valid and/or the Signature is unknown.

• Document Contents

  The Document Contents clause is present in the Sanitize Document Content content rule. It looks for the following metadata included in documents:

  • Previous revision history
  • Comments

• Document Properties

  The Document Properties clause is present in the Sanitize Document Content content rule. It looks for information contained in the metadata of an attachment or a document. You can use this clause to scan a file for various predefined properties, such as subject matter, as well as any custom document properties belonging to a file.

  To define the clause:

  1. Open the editing page for the Sanitize Document Content content rule.
  2. In the What To Look For? panel, click Click here to change these settings for the Document Properties.

  3. Select the properties you want to detect:

     Category	Description	Microsoft Office	Libre Office	Adobe PDF	Image files (e.g. GIF, JPEG, PNG, WEBP, SVG)
     Subject matter	Document properties such as Title, Subject and Keywords	Categories, Comments, Status, Subject, Tags, Title	Comments, Keywords, Subject, Title	Keywords, Subject, Title	Title, Description, Keywords, Subject
     User information	Properties identifying an individual, such as Author or Owner	Author, Company, Last modified by (user), Manager	Created (user), Last printed (user), Modified (user)	Author	Artist, Author, Company, Writer/Editor
     Infrastructure information	Properties containing environmental information, including printer information	Template, printer information	Application, Producer, printer information	Application, Producer	Creator, Producer, Program Version
     Location information	GPS Location information added to a JPEG image by a device	-	-	-	Location information
     Miscellaneous information	Standard application properties that are not relevant to a specific category	Created (date), Last modified (date), Last printed (date), Revision number	Created (date), Last printed (date), Modified (date), Revision number, Total editing time	Created (date), Modified (date)	Creation Date, Copyright, Language, Unique ID
     Rogue properties	Properties that are either malformed or found in an unexpected location	Various	Various	Various	Various
     Custom properties	Properties created by the author using a facility within the authoring tool	Various	Various	Various	Various

     Custom properties must not contain commas "," or exclamation marks "!" as these characters are not supported and will not be correctly detected or sanitized.

  4. Click Save.
  5. Apply the configuration.

  If you change any configuration or policy settings, you must Apply Configuration for the new settings to take effect. You can do this either from the Changes Made panel, or System > Configuration > Apply Configuration. See Apply new configuration for more information. If you use Peer Gateways (i.e. when multiple Gateways are peered), any configuration changes from a local Gateway can then be applied to all the peers at the same time. See Peer Gateways for more information.

• Images

  The Images clause is present in the Sanitize Document Content content rule. It specifies whether to Remove potential embedded data, such as data encoded using steganographic techniques, from images in supported file types.

  This setting is disabled by default. When enabled:

  • The Gateway attempts to remove potential embedded data from the supported image types (GIF, JPEG, BMP, PCX, PNG, PBM, PGM, PPM, TIFF, WEBP, SVG).

  • Imperceptible modifications are made to "all" such images that pass through the system.

    All images are always sanitized, because it is not possible to precisely detect the existence of embedded data. Reprocessing a modified message might trigger a further image sanitization pass.

• Lexical Expression

  The Lexical Expression clause looks for words, phrases or specific lexical expressions. The clause uses Lexical Expression Lists as a reference and can be used to detect phrases that violate your security policy.

  The Lexical Expression clause enables you to configure a content rule to look for specific lexical expressions in:

  • Message content
  • Subject lines
  • Message headers
  • Attachments (matching the conditions in the other clauses in the content rule)

  Lexical expressions are words or phrases that can be specifically detected. They are grouped together in lexical expression lists, which you can add to the Lexical Expression clause.

  To define a Lexical Expression clause in a content rule:

  1. Click Click here to change these settings.
  2. Select your Expression list from the drop-down menu.

  3. Select the Trigger required for the content rule to measure the weight of detected expressions.

     • Greater than or equal - The rule will trigger if the Threshold (specified by the expression list) is matched or exceeded.
     • Less than and no forced triggers - The rule will trigger if the Threshold is neither matched nor exceeded.

  4. Select the parts of the message you want the content rule to scan.

     For each of the message parts (including each separate attachment) the content rule considers the parts separately.

  5. Select the combination of Document Options you want to scan, where applicable.

     • Scan body
     • Scan header and footer
     • Scan properties
     • Scan comments
     • Scan embedded script

     By default, the content rule considers each document part separately. For example, if a detected term with weight +6 appears in the body and the header of the document, the total weight = +6.

  For more information on how to create a list of lexical expressions, see Create a lexical expression. To find out more about lexical expressions in general, including weighting, thresholds and triggers, see Lexical Expressions.

• Malware Outbreak Detection

  The Malware Outbreak Detection clause identifies messages that potentially contain malware. You can Enable Detection on a Detect Virus content rule. You can then configure the content rule to discard or hold the message in a message area.

  This feature is only available in Secure Email Gateway. If you are using Secure Email Gateway without an anti-virus product, you can still use this feature.

• Message has Failed to be Modified

  The Message has Failed to be Modified clause looks for messages which have failed to be modified by the Gateway. The content rule then automatically applies the What to Do actions to those messages.

  You cannot edit this clause.

• Message has Failed to be Processed

  The Message has Failed to be Processed clause looks for messages which have failed to be processed by the Gateway. The content rule then automatically applies the What to Do actions to those messages.

  You cannot edit this clause.

• Message Size Restriction

  The Message Size Restriction clause detects messages that violate a specified size limit.

  You can:

  • Configure a size limit between 0 and 2,097,150 KB (2.1 GB)

  • Configure the size limit as either a maximum or a minimum value. For example, applying a restriction of 1,000,000 KB or more detects messages smaller than 1 GB.

• Missing Manager Detection

  The Missing Manager Detection clause is a What To Look For? clause in a Missing Manager content rule. It looks for messages that have been sent without the sender's manager in the list of recipients (in the To or CC fields). You can configure the clause to ignore exceptions.

  You can also edit this clause when editing the global Manage Missing Manager Policy content rule, accessible by navigating to Policy > Missing Manager. For more information regarding the global policy, refer to Missing Manager.

  To define the clause:

  1. Open the editing page for the Missing Manager content rule.
  2. Beside the Missing Manager Detection clause in the What To Look For? area of the content rule, click Click here to change these settings.
  3. By default, the content rule will always trigger if the message does not include the sender's manager but you can set the clause to ignore messages that meet certain conditions. Enable the check boxes if you want to:
     • Ignore messages where the sender is in the relationships list with no manager
     • Ignore messages that have no attachment

     See Manager Relationships for more information on defining manager relationships, viewing a sender's manager, and updating this information.

  4. Click Save.
  5. Apply the configuration.

  If you change any configuration or policy settings, you must Apply Configuration for the new settings to take effect. You can do this either from the Changes Made panel, or System > Configuration > Apply Configuration. See Apply new configuration for more information. If you use Peer Gateways (i.e. when multiple Gateways are peered), any configuration changes from a local Gateway can then be applied to all the peers at the same time. See Peer Gateways for more information.

• Mode

  The Mode clause enables you to specify the mode of operation used by the Sanitize Message content rule. You can select either:

  • Detect only
  • Detect and sanitize

  Mode applies to the Sanitize Message content rule.

• HTML and RTF Email Bodies

  The HTML and RTF Email Bodies clause looks for content in rich text or HTML in a message body. You can select whether you want to convert rich text into plain text, or search for specific threats in the message body, such as embedded images, active content or links to other resources.

  HTML and RTF Email Bodies applies to the Sanitize Message content rule.

• Restrict the Number of Attachments

  The Restrict the Number of Attachments clause looks for messages which include more than a specified number of attachments. You can restrict the number of attachments to a number between 0 and 100. For example, if you configure the value to 5, the clause looks for messages with 6 or more attachments.

  The Restrict the Number of Attachments Clause is used in the Attachment Count Restriction content rule template.

• Run External Command

  The Run External Command clause looks for details of the executable program that the Gateway is to run. See Run external command for more information.

• Scan text extracted from images (OCR)

  Scan text extracted from images (OCR) enables you to extract and scan text from images, optionally including QR codes and barcodes, by using OCR (Optical Character Recognition) technology.

  You can configure the OCR settings from System > Gateway Settings > Policy Engine Settings. See Advanced and OCR for more information.

• Size Restriction

  The Size Restriction clause is present in the Analyze Properties, Detect Lexical Expression, Detect Media Types and Redact Text content rules. It detects files that violate a specified size limit.

  The Size Restriction clause is often used in conjunction with the Which Media Types clause. For example, you can create a Detect media types content rule that detects large image files.

  • This clause is disabled by default, but the value can be configured up to 2 GB.

  • Configure the size limit as either a maximum or a minimum value. For example, applying a restriction of 1,000,000 KB or more detects files smaller than 1 GB.

• Spam Detection

  The Spam Detection clause uses SpamLogic to look for indicators of spam contained in a message. Spam Logic uses several methods to detect spam.

  You can configure the clause to trigger when spam is detected by any of the following methods:

  • Bad reputation returned by TRUSTmanager
  • Real-time IP Blocklist
  • Spoof Detection
  • BATV Bounce Address Tag Validation Address Validation
  • SPF Sender Policy Framework Hard Fail
  • SPF Soft Fail
  • DMARC Domain-based Message Authentication, Reporting & Conformance Reject
  • DMARC Quarantine
  • DKIM DomainKeys Identified Mail Hard Fail
  • DKIM Soft Fail
  • Confirmed Phishing Email
  • Suspected Phishing Email
  • Confirmed Spam Email
  • Suspected Spam Email

• Unacceptable Images

  The Unacceptable Images clause is a What To Look For? clause in the Detect Unacceptable Images content rule, which looks for unacceptable images, based on a user-specified threshold (by ImageLogic).

  ImageLogic rates the acceptability of each image it scans by assigning it a score based on its content. Higher scores are considered to be less acceptable than lower scores. Images scoring higher than the threshold value you've set are considered unacceptable and the appropriate action (typically quarantine) is applied by the content rule.

  To define the clause:

  1. Open the editing page for the Detect Unacceptable Images content rule.
  2. Beside the Unacceptable Images clause in the What To Look For? area of the content rule, click Click here to change these settings.
  3. Click the appropriate radio button to either:
     • Use the default threshold of 46.
     • Enter a threshold of (user-defined value between 1 and 100).

     The ImageLogic threshold change only applies to this specific content rule.

  4. Click Save.

  5. Apply the configuration.

  Raising the threshold reduces the possibility of false positives, such as images containing flesh tones (but not full or partial nudity). Be aware that the default threshold value may change automatically during a system update, as the behavior of ImageLogic is refined.

  For more information about classifying images in ImageLogic, refer to ImageLogic.

  If you change any configuration or policy settings, you must Apply Configuration for the new settings to take effect. You can do this either from the Changes Made panel, or System > Configuration > Apply Configuration. See Apply new configuration for more information. If you use Peer Gateways (i.e. when multiple Gateways are peered), any configuration changes from a local Gateway can then be applied to all the peers at the same time. See Peer Gateways for more information.

• URLs and Hyperlinks

  The URLs and Hyperlinks clause looks for specific URLs or hyperlinks to URLs. You can specify a selection of URL Lists to search for, and exclude any URLs that are known to be trusted.

  You can configure the Gateway to look for URLs and Hyperlinks in the following content rules:

  • Sanitize Document Content - detect and remove URLs and hyperlinks from documents.
  • Sanitize Message - detect and remove URLs and hyperlinks from messages.

  See URL Lists to find out how to create a custom list of URLs.

  Sanitize Document Content

  To define the URLs and Hyperlinks clause in a Sanitize Document Content rule:

  1. Click Click here to change these settings

  2. Select Remove URLs and Hyperlinks in Documents.

     This enables you to remove either:

     • All URLs and Hyperlinks
     • Only the URLs defined in the selected lists - select a URL list from the options available.

     You can also add URL lists as exceptions using the Except URLs defined in the selected lists box.

  3. Click Save.

  Sanitize Message

  To define the URLs and Hyperlinks clause in a Sanitize Message rule:

  1. Click Click here to change these settings

  2. Select the part of a message you want to scan:

     • Message subjects
     • Message bodies

     This enables you to remove either:

     • All URLs and Hyperlinks
     • Only the URLs defined in the selected lists - select a URL list from the options available.

     You can also add URL lists as exceptions using the Except URLs defined in the selected lists box.

  3. Click Save.

  URL Rewriting

  You can also re-write URLs using a configurable format, in order to ensure detected URLs in message subjects or bodies are automatically scannable by your external web protection software.

  The content rule must be operating in Detect and Sanitize mode.

  Use tokens in your format:%URL% (the original URL) or %URL64% (the original URL base-64 encoded). Please consult the guidelines provided with your external web protection software to confirm the correct format.

  Examples:

  • https://myservice.com/scan?url=%URL%
  • myserver://scan?%URL%
  • https://192.168.1.10?q=%URL%

  If a policy route includes a Sanitize Message rule designed to rewrite URLs, but also a Redact Text rule configured to redact URLs, a detected message is held as a Modification Failure.

• Virus Detection

  The Virus Detection clause searches for viruses in a message using virus types.

  The Malware Outbreak Detection clause searches for known malware in a message.

  The Scan with sandbox clause allows you to identify malicious content that falls beneath a pre-determined threshold value.

  For more information, refer to Detect Virus.

  You cannot edit the Virus Detection clause.

• Which Media Types

  The Which Media Types clause looks for selected media types. You can use a Which Media Types clause to look for types of file (for example, documents or images) or file extensions.

  It is used in a number of different contexts, and enables you to do the following:

  • Include all media types - detects every media type recognised by the Gateway.
  • Include selected media types - enables you to select the file types or extensions you require from a list.
  • Exclude selected media types - adds an exception list of media types that will not be detected by the content rule.

  Some content rules restrict the options to Include selected media types and might have a set of file types preselected, as appropriate for the rule. You can change the selection, if necessary.

  To define the clause:

  1. Open the editing page for a relevant content rule.
  2. In the What To Look For? panel, click Click here to change these settings.

  3. Select which media types to include (or exclude). Selected media types are displayed with a check box in the Detectable Types list. You can expand or collapse this list to refine your selection if necessary.

  4. Add Selection Modifiers:

     • Include the media type of the message body - this scans only the body of the top level message and ignores any attached messages.

     • Include media types within attachments - scans for media types contained within attachments, such as ZIP files.

       You can add Selection Modifiers on the Detect media types content rule and the Check Registered Data content rule.

  5. Click Save.

  6. Apply the configuration.

  If you change any configuration or policy settings, you must Apply Configuration for the new settings to take effect. You can do this either from the Changes Made panel, or System > Configuration > Apply Configuration. See Apply new configuration for more information. If you use Peer Gateways (i.e. when multiple Gateways are peered), any configuration changes from a local Gateway can then be applied to all the peers at the same time. See Peer Gateways for more information.

• Which Message Types

  The Which Message Types clause looks for potentially harmful message types, such as phishing, suspected spam, or newsletters. This clause is used in the Sanitize Message content rule, and can be configured to apply to All messages or Selected messages.

• With a Filename of...

  The Filename clause is present in the Detect Media Types and Detect Filename content rules.

  The Filename clause looks for specific filenames using pre-configured Filename Lists. Filename Lists consist of filename identifiers you might want the Gateway to intercept using this clause. You can specify whether the rule will trigger if the filenames are detected or if they are not detected.

  To find out more about creating or modifying a list of filenames, see Filename Lists.