Open with table of contents

What To Look For? Clauses

What To Look For? clauses look for conditions that must be met to trigger a content rule.

If a content rule contains multiple clauses, a message (or web traffic) must meet all the conditions defined by all the clauses to trigger the content rule. This topic contains a brief overview of all the What To Look For? clauses the ARgon Server uses in content rules.

What to Look For?

• Always Trigger the Rule

  The Always Trigger the Rule clause specifies that the content rule must always be triggered.

  You cannot edit this clause.

• Analyze Properties

  The Analyze Properties clause looks for a Document Properties expression list in attached files and documents. These lists match specific string values with specific document properties. See About Document Properties for more information.

  The Analyze Properties clause is used in the Analyze Properties content rule template.

• Data Transfer Restriction

  The Data Transfer Restriction clause identifies large file transfers and excludes them from content scanning.

  You can configure the threshold value. File transfers which are larger than this threshold value will not be scanned.

  The default threshold value is 2,040 MB (2GB).

• Detect Malformed Data

  The Detect Malformed Data content rule enables you to handle messages that include malformed data. For example, you might want to hold any messages containing a PDF attachment identified as containing malformed data. This enables you to review those messages and then release or reject them at a later time.

  The Detect Malformed Data content rule operates on selected Media Types. You can exclude or include certain types (such as PDF) using a combination of Detect Malformed Data content rules.

• Direction

  The Direction clause looks for data that is either entering or leaving your organization. You can use this clause to restrict a content rule to search for outbound or inbound items.

  You can configure a content rule to apply, where the item was detected...

  • either leaving or entering the company
  • leaving the company (uploading)
  • entering the company (downloading)

• Document Properties

  The Document Properties clause looks for information contained in the meta-data of an attachment or document. You can use this clause to scan a file for user information, revision history, subject matter or any custom document properties belonging to a file.

  Category	Description	Microsoft Office	Open Office	Adobe PDF	JPEG
  Previous Revision History	Document history such as tracked changes	Revision history	Revision history	Review	-
  Subject Matter	Document properties such as Title, Subject and Keywords	Categories, Comments, Status, Subject, Tags, Title	Comments, Keywords, Subject, Title	Keywords, Subject, Title	Title, Description, Keywords, Subject
  User Information	Properties identifying an individual, such as Author or Owner	Author, Company, Last modified by (user), Manager	Created (user), Last printed (user), Modified (user)	Author	Artist, Author, Company, Writer/Editor
  Infrastructure Information	Properties containing environmental information	Template	Application, Producer	Application, Producer	Creator, Producer, Program Version
  Miscellaneous Information	Standard application properties that are not relevant to a specific category	Created (date), Last modified (date), Last printed (date), Revision number	Created (date), Last printed (date), Modified (date), Revision number, Total editing time	Created (date), Modified (date)	Creation Date, Copyright, Language, Unique ID
  Rogue Properties	Properties that are either malformed or found in an unexpected location	Various	Various	Various	Various
  Custom Properties	Properties created by the author using a facility within the authoring tool.	Various	Various	Various	Various
  Comments	User comments added by reviewers or document owners	Comments	Comments	Comments	User comments, keywords
  Location	GPS Location information added to a JPEG image by a device	-	-	-	Location information

• Lexical Expression

  The Lexical Expression clause looks for words, phrases or specified Lexical Expressions. The clause uses Lexical Expression Lists as a reference and can be used to detect phrases which violate your security policy.

  You can:

  • Scan any combination of the following parts of a transaction:

    For a mail message:

    • The message body
    • The subject line

    • The attachments matching the conditions in the other clauses

    • Specific message header(s)

    • Content

    For a web transaction:

    • HTTP Headers
    • Request URL

    • Content

    For each of the message parts (including each separate attachment) the content rule considers the parts separately.

  • Select an expression list.
  • Create a new expression list. Show me how...

    1. Click the Expression list drop-down menu.
    2. Select (Create a new expression list).
    3. Save.
    4. Click Policy > Lexical Expressions. Your new list has been added to the available lexical expression lists.

    5. Select and click Edit to rename and configure the new expression list.

       For more information, see Working with Lexical Expressions.

  • Select a Trigger value for your expression list. This determines how the content rule measures the weight of detected expressions.

    • Greater than or equal - The rule will trigger if the Threshold (specified by the expression list) is matched or exceeded.
    • Less than and no forced triggers - The rule will trigger if the Threshold is neither matched nor exceeded.

  • Apply any combination of the following Document options (where applicable) to scan any Microsoft Office or OpenOffice documents:

    • Scan body
    • Scan header and footer
    • Scan properties
    • Scan comments
    • Scan embedded script

    By default, the content rule considers each document part separately. For example, if a detected term with weight +6 appears in the body and the header of the document, the total weight = +6.

• Message has Failed to be Processed

  The Message has Failed to be Processed clause looks for messages which have failed to be processed by the ARgon Server. The content rule then automatically applies the What to Do actions to those messages.

  You cannot edit this clause.

• Restrict the Number of Attachments

  The Restrict the Number of Attachments clause looks for messages which include more than a specified number of attachments. You can restrict the number of attachments to a number between 0 and 100. For example, if you configure the value to 5, the clause looks for messages with 6 or more attachments.

  The Restrict the Number of Attachments Clause is used in the Attachment Count Restriction content rule template.

• Which Media Types

  The Which Media Types clause looks for selected media types in a message.

  You can:

  • Include all media types. Selects all currently detectable media types.
  • Include selected media types. You can select individual media types, or categories.
  • Exclude selected media types. You can exclude individual media types, or categories.

  For a mail message you can also:

  • Include the media type of the message body. Scans only the body of the top level message and ignores any attached messages.
  • Include media types within attachments. Scans for media types contained within attachments such as ZIP files.

  For most content rule types, you can include individual media types, or categories such as Documents, Image Types or Compressed Files. The Analyze Properties content rule restricts this list to Documents only.

• With a Filename of...

  The Filename clause looks for specific filenames using pre-configured Filename Lists. Filename Lists consist of filename identifiers you might want the ARgon Server to intercept using this clause.

  Content rules created from a Detect Media Types or Detect Filename template. You can specify whether the rule will trigger if the filenames are detected or if they are not detected.

  To find out more about creating or modifying a list of filenames, see the topic About Filename Lists.