Open with table of contents

What To Look For? Clauses

What To Look For? clauses look for conditions that must be met to trigger a content rule.

If a content rule contains multiple clauses, a message (or web traffic) must meet all the conditions defined by all the clauses to trigger the content rule. This topic contains a brief overview of all the What To Look For? clauses the Gateway uses in content rules.

What to Look For?

• Always Trigger the Rule

  The Always Trigger the Rule clause specifies that the content rule must always be triggered.

  You cannot edit this clause.

• Analyze Properties

  The Analyze Properties clause looks for a Document Properties expression list in attached files and documents. These lists match specific string values with specific document properties. See About Document Properties for more information.

  The Analyze Properties clause is used in the Analyze Properties content rule template.

• Attachments

  The Attachments clause enables you to remove attachments using the Sanitize Message content rule. If you select the Remove Attachments check box, any attachments in detected messages will be removed.

  Attachments applies to the Sanitize Message content rule.

• Cryptographic Failure

  The Cryptographic Failure clause looks for instances where encryption or decryption has failed.

  You can configure the clause to trigger:

  • If a message cannot be encrypted

  • If a message cannot be decrypted

  The Cryptographic Failure clause is used in the Encryption or decryption fails content rule template.

• Data Transfer Restriction

  The Data Transfer Restriction clause identifies large file transfers and excludes them from content scanning.

  You can configure the threshold value. File transfers which are larger than this threshold value will not be scanned.

  The default threshold value is 2,040 MB (2GB).

• Detect Malformed Data

  The Detect Malformed Data content rule enables you to handle messages that include malformed data. For example, you might want to hold any messages containing a PDF attachment identified as containing malformed data. This enables you to review those messages and then release or reject them at a later time.

  The Detect Malformed Data content rule operates on selected Media Types. You can exclude or include certain types (such as PDF) using a combination of Detect Malformed Data content rules.

• Digital Signature Validation

  The Digital Signature Validation clause looks for digital signatures. You can configure the clause to look for instances where:

  • The transaction Does not have a digital signature
  • All the digital signatures are valid
  • At least one digital signature is valid

  • There is an issue with a digital signature.

    You can specify the clause to look for the conditions where the Signature is NOT valid and/or the Signature is unknown.

• Direction

  The Direction clause looks for data that is either entering or leaving your organization. You can use this clause to restrict a content rule to search for outbound or inbound items.

  You can configure a content rule to apply, where the item was detected...

  • either leaving or entering the company
  • leaving the company (uploading)
  • entering the company (downloading)

• Document Properties

  The Document Properties clause looks for information contained in the meta-data of an attachment or document. You can use this clause to scan a file for user information, revision history, subject matter or any custom document properties belonging to a file.

  Category	Description	Microsoft Office	Open Office	Adobe PDF	JPEG
  Previous Revision History	Document history such as tracked changes	Revision history	Revision history	Review	-
  Subject Matter	Document properties such as Title, Subject and Keywords	Categories, Comments, Status, Subject, Tags, Title	Comments, Keywords, Subject, Title	Keywords, Subject, Title	Title, Description, Keywords, Subject
  User Information	Properties identifying an individual, such as Author or Owner	Author, Company, Last modified by (user), Manager	Created (user), Last printed (user), Modified (user)	Author	Artist, Author, Company, Writer/Editor
  Infrastructure Information	Properties containing environmental information	Template	Application, Producer	Application, Producer	Creator, Producer, Program Version
  Miscellaneous Information	Standard application properties that are not relevant to a specific category	Created (date), Last modified (date), Last printed (date), Revision number	Created (date), Last printed (date), Modified (date), Revision number, Total editing time	Created (date), Modified (date)	Creation Date, Copyright, Language, Unique ID
  Rogue Properties	Properties that are either malformed or found in an unexpected location	Various	Various	Various	Various
  Custom Properties	Properties created by the author using a facility within the authoring tool.	Various	Various	Various	Various
  Comments	User comments added by reviewers or document owners	Comments	Comments	Comments	User comments, keywords
  Location	GPS Location information added to a JPEG image by a device	-	-	-	Location information

• Download Size Restriction

  The Download Size Restriction clause specifies the maximum size of files that can be downloaded.

  You can configure the size limit by entering a value in Download Size Restriction clause. The default value is 2MB. If a download exceeds the size limit, the download will be aborted.

• Lexical Expression

  The Lexical Expression clause looks for words, phrases or specified Lexical Expressions. The clause uses Lexical Expression Lists as a reference and can be used to detect phrases which violate your security policy.

  You can:

  • Scan any combination of the following parts of a transaction:

    For a mail message:

    • The message body
    • The subject line

    • The attachments matching the conditions in the other clauses

    • Specific message header(s)

    • Content

    For a web transaction:

    • HTTP Headers
    • Request URL

    • Content

    For each of the message parts (including each separate attachment) the content rule considers the parts separately.

  • Select an expression list.
  • Create a new expression list. Show me how...

    1. Click the Expression list drop-down menu.
    2. Select (Create a new expression list).
    3. Save.
    4. Click Policy > Lexical Expressions. Your new list has been added to the available lexical expression lists.

    5. Select and click Edit to rename and configure the new expression list.

       For more information, see Working with Lexical Expressions.

  • Select a Trigger value for your expression list. This determines how the content rule measures the weight of detected expressions.

    • Greater than or equal - The rule will trigger if the Threshold (specified by the expression list) is matched or exceeded.
    • Less than and no forced triggers - The rule will trigger if the Threshold is neither matched nor exceeded.

  • Apply any combination of the following Document options (where applicable) to scan any Microsoft Office or OpenOffice documents:

    • Scan body
    • Scan header and footer
    • Scan properties
    • Scan comments
    • Scan embedded script

    By default, the content rule considers each document part separately. For example, if a detected term with weight +6 appears in the body and the header of the document, the total weight = +6.

• Malware Outbreak Detection

  The Malware Outbreak Detection clause identifies messages that potentially contain malware. You can Enable Detection on a Detect Virus content rule. You can then configure the content rule to discard or hold the message in a message area.

  This feature is only available on the Clearswift SECURE Email Gateway. If you are using a SEG Lite that does not provide an anti-virus product, you can still use this feature.

• Message has Failed to be Processed

  The Message has Failed to be Processed clause looks for messages which have failed to be processed by the Gateway. The content rule then automatically applies the What to Do actions to those messages.

  You cannot edit this clause.

• Message Size Restriction

  The Message Size Restriction clause measures the size of a message and triggers the content rule if the whole message violates the size limit.

  Size Restriction is often used in conjunction with the Which Media Types clause. An example of this combination is a content rule which detects large image files.

  Use the Message Size Restriction clause to deliver oversized messages at off-peak times by combining it with a Scheduled Message Release. This helps to minimize bandwidth during core operating hours.

  You can:

  • Configure a size limit between 0 and 2 GB.

  • Configure the size limit as either a maximum or a minimum value. For example, applying a restriction of 1,000,000 KB or more detects messages smaller than 1 GB.

• Mode

  The Mode clause enables you to specify the mode of operation used by the Sanitize Message content rule. You can select either:

  • Detect only
  • Detect and sanitize

  Mode applies to the Sanitize Message content rule.

• Rich Text Email Bodies

  The Rich Text Email Bodies clause looks for content in rich text or HTML in a message body. You can select whether you want to convert rich text into plain text, or search for specific threats in the message body, such as embedded images, active content or links to other resources.

  Rich Text Email Bodies applies to the Sanitize Message content rule.

• Real-time Categorization

  The Real-time Categorization clause checks the content of uncategorized sites in real-time. If the current policy allows access to uncategorized sites, this clause provides additional protection. You can select the categories to be detected.

  All categories detect English content. However, the 'Pornography' category also looks for content in any of the following languages: Chinese, Czech, Danish, Dutch, Finnish, French, German, Italian, Japanese, Korean, Norwegian, Polish, Portuguese, Russian, Spanish, Swedish and Turkish.

• Request or response has failed to be processed

  The Request or Response has Failed to be Processed clause looks for failures to process a request or a response by the policy engine. The content rule can be configured to generate an inform or block the communication in a controlled manner.

• Restrict the Number of Attachments

  The Restrict the Number of Attachments clause looks for messages which include more than a specified number of attachments. You can restrict the number of attachments to a number between 0 and 100. For example, if you configure the value to 5, the clause looks for messages with 6 or more attachments.

  The Restrict the Number of Attachments Clause is used in the Attachment Count Restriction content rule template.

• Run External Command

  The Run External Command clause looks for details of the executable program that the Gateway is to run. See Triggering the Run external command content rule for more information on this clause.

• Spam Detection

  The Spam Detection clause uses SpamLogic to look for indicators of spam contained in a message. Spam Logic uses several methods to detect spam.

  You can configure the clause to trigger when spam is detected by any of the following methods:

  • Bad reputation returned by TRUSTmanager
  • Real-time IP Blocklist
  • Spoof Detection
  • BATVBounce Address Tag Validation Address Validation
  • DMARCDomain-based Message Authentication, Reporting & Conformance Reject

  • DMARC Quarantine

  • SPFSender Policy Framework Hard Fail
  • SPF Soft Fail
  • DKIMDomainKeys Identified Mail Hard Fail
  • DKIM Soft Fail
  • Confirmed Junk Email
  • Suspected Junk Email

• Spyware Call Home

  The Spyware Call Home clause looks for any existing spyware which is attempting to 'call home' by contacting computers outside your organization.

  You cannot edit this clause.

• Spyware Detection

  The Spyware Detection clause looks for inbound spyware inside HTTP or Browser FTP connections.

  The spyware defense uses a database of unique signatures that are used to identify particular types of spyware.

  You cannot edit this clause.

• Tracking Cookie Detection

  The Tracking Cookie Detection clause looks for cookies which track spyware in traffic in and out of your organization.

  You cannot edit this clause.

• Unacceptable Images

  The Unacceptable Images clause looks for messages which are classified as unacceptable by ImageLogic.

  ImageLogic rates the acceptability of each image it scans by assigning it a score based on its content. Higher scores are considered to be less acceptable than lower scores. Images scoring higher than a certain threshold value are considered unacceptable and the appropriate action (typically quarantine) is applied by the content rule.

  You can configure the threshold value for ImageLogic by doing either of the following:

  • Use the default threshold of (default value).
  • Enter a threshold of (user-defined value between 0 and 100).

• URLs and Hyperlinks

  The URLs and Hyperlinks clause looks for specific URLs or hyperlinks to URLs within a message body. You can specify a selection of URL Lists to search for, and exclude any URLs which are known to be trusted. See URL Lists to find out how to create a custom list of URLs.

  URLs and Hyperlinks applies to the Sanitize Message content rule.

• Virus Detection

  The Virus Detection clause searches for viruses in a message using virus types.

  You cannot edit this clause.

• When Message is Missing a Manager

  The The message is missing a manager clause looks for messages which have been sent without including the sender's manager in the list of recipients. You can configure the clause to add exceptions.

  You can configure the clause to ignore messages where the sender:

  • Does not have a manager.
  • Is not in the manager relationships list.

  The clause can also be configured to detect messages with attachments. You can configure the The message is missing a manager clause to:

  • Ignore if sender has not included an attachment.

• Which Media Types

  The Which Media Types clause looks for selected media types in a message.

  You can:

  • Include all media types. Selects all currently detectable media types.
  • Include selected media types. You can select individual media types, or categories.
  • Exclude selected media types. You can exclude individual media types, or categories.

  For a mail message you can also:

  • Include the media type of the message body. Scans only the body of the top level message and ignores any attached messages.
  • Include media types within attachments. Scans for media types contained within attachments such as ZIP files.

  For most content rule types, you can include individual media types, or categories such as Documents, Image Types or Compressed Files. The Analyze Properties content rule restricts this list to Documents only.

• Which Message Types

  The Which Message Typesclause looks for selected message types such as confirmed or suspected junk mail, confirmed or suspected phishing messages and newsletters. This What to Look For? clause is used in the Sanitize Message content rule to determine which messages are detected or sanitized.

• With a Filename of...

  The Filename clause looks for specific filenames using pre-configured Filename Lists. Filename Lists consist of filename identifiers you might want the Gateway to intercept using this clause.

  Content rules created from a Detect Media Types or Detect Filename template. You can specify whether the rule will trigger if the filenames are detected or if they are not detected.

  To find out more about creating or modifying a list of filenames, see the topic About Filename Lists.