Open with table of contents

What To Do? Actions

What To Do? actions determine the outcome of content rules. They specify how the Gateway should handle content that has been detected.

You can add additional What Else To Do? actions to a content rule. For example, in addition to holding or blocking a virus, you might want to Generate an Inform to notify an administrator.

Tell me about...

The following What Else To Do? actions can be applied to content rules:

• Generate an Inform

  The Generate an Inform action sends a notification email to specified recipients to inform them of the actions taken during Gateway message processing. For example, you can automatically inform an individual that the Gateway detected a threat, such as a virus, in an email.

  To configure a Generate an Inform action:

  1. Specify the conditions required for the inform to be sent:

     • If the "What to Look For?" conditions are met
     • If the conditions are met AND the disposal action is performed
     • If the conditions are met BUT the disposal action is not performed

  2. Select an inform from a list of available templates and customize the content.

     To create a new inform template, select (Create a new inform) from the drop-down menu and Save your changes. The inform is displayed as Using the template: 'Inform for [content rule name]'. Click the template name to modify the Inform.

  3. Specify the recipients who will receive the inform message:

     • Message Recipients: The recipients of the original message.

     • Message Originator: The sender of the original message.

       By default, the Gateway uses the address in the "From:" field of an email header to define who the Message Originator is. Select the Use Reply-to if available option if you would rather use the address in "Reply-to:" field of an email header as the Message Originator. If no address exists in the "Reply-to:" field, the Gateway uses the address in the "From:" field by default.

     • The sender's manager: The manager of the person who sent the original message.

     • Server Administrator: The system administrator.
     • This email address: An email address that you specify.

  4. Select Consolidate informs for the same message ID to consolidate multiple Inform notifications.

     In some hosted platforms (such as Gmail), messages sent to multiple recipients are split into multiple messages, each with a single recipient. If you have a policy that uses the Missing Manager feature then the Gateway sends an Inform to a manager or server administrator for each email that breached policy. Selecting Consolidate informs for the same message ID consolidate these notifications into a single Inform.

     Selecting this option can reduce the number of manager notifications you receive for the same message if you are using Missing Manager. If you use the %RCPTS% token in an inform then the inform will only contain the recipients of the split message and not the recipients of the original message. To see the full list of recipients for the original message, you must include the original message in the inform. For information on where to change these settings, see step 4 in Creating an Inform.

  To lessen the chances of an unauthorized user having access to personal and confidential information provided by aGateway inform, we recommend that if an inform is configured with the following in mind: Do not include the original or modified message, or textual analysis results Keep the inform message subject and body short with only minimum information Inform tokens act as substitutions for variables such as URL or the message sender. You should use the minimum number of inform tokens when configuring an inform, ideally %DATE%, %SENDER%, %UNIQUEID% and %DOC_NAME% only. Do not use inform tokens that could expose content of the email, for example %RCPTS% and %SUBJECT%. For a full list of inform tokens that you can use, see Using Tokens in Content Rules and Policy References. Consider who will receive the inform. The Gateway options for who receives the inform are listed in the steps above.

  Using Informs with an IG Server

  If you are using an IG Server, you can also copy the inform to document owners so that document owners who have registered documents on the IG Server can be notified of policy violations.

  Using informs with the Check Registered Data content rule when alerting Information Governance policy matches To lessen the chances of an unauthorized user having access to personal and confidential information provided by a Gateway inform, we recommend that if an inform is configured to be sent to anyone other than an IGS Compliance Officer, you take the following steps: Do not include the original or modified message, or textual analysis results Keep the inform message subject and body short with only minimum information Inform tokens act as substitutions for variables such as URL or the message sender. You should use the minimum number of inform tokens when configuring an inform, ideally %DATE%, %SENDER%, %UNIQUEID% and %DOC_NAME% only. Do not use inform tokens that could expose content of the email, for example %RCPTS% and %SUBJECT%. For a full list of inform tokens that you can use for IG Server queries, see Using Tokens in Content Rules and Policy References. You should also consider configuring separate Informs for Compliance Officers and other IGS roles. You can then configure the Compliance Officer Inform to provide more information.

• Send a Copy (Relay Server)

  You can send a copy of a detected message to an archive on a relay server using the Send a Copy (Relay Server) action. You can specify the conditions required for the message to be copied and select the server from the To: list.

  • If the "What to Look For?" conditions are met
  • If the conditions are met AND the disposal action is performed
  • If the conditions are met BUT the disposal action is not performed

  Add a relay server to the list by clicking Policy Center > Disposal Actions. Select the Relay Servers tab and click New.

• Send a Copy (BCC)

  You can send a copy of a detected message to a specified email address using the Send a Copy (BCC) action. You can specify the conditions required for the message to be copied, the recipient of the copied message and whether you want to send the Original or Modified version of the message.

  • If the "What to Look For?" conditions are met
  • If the conditions are met AND the disposal action is performed
  • If the conditions are met BUT the disposal action is not performed

  Copies of emails are sent to the selected email address without encryption. If this rule is used on a mail route with encryption enabled, you should make sure that performing this action will not leak sensitive information in copied messages.

• Log a Message

  The Log a Message action writes a line of text to the Policy Enforcement log. You can specify the conditions required to generate the log entry and enter the log text (up to 160 characters).

  • If the "What to Look For?" conditions are met
  • If the conditions are met AND the disposal action is performed
  • If the conditions are met BUT the disposal action is not performed

  You can include supported tokens in your log text. See the topic, Using Tokens for details.

• Generate an Alert

  The Generate an Alert action sends a user-defined alert to a specified recipient. You can specify the conditions required to generate the alert and enter the alert text (up to 160 characters).

  • If the "What to Look For?" conditions are met
  • If the conditions are met AND the disposal action is performed
  • If the conditions are met BUT the disposal action is not performed

  Specify the alert recipient by clicking System > System Settings > Policy Engine Settings. Use the Alert Settings panel to configure the way alerts are delivered.

• Tag the Message Subject

  The Tag the Message Subject action appends a text fragment to the start or end of a subject. You can enter the text (up to 78 characters) and whether you want it to be tagged to the start or end of the subject header.

• Annotate the Message

  The Annotate the Message action appends a portion of text or HTML to the body of a message. For example, you might wish to add a disclaimer or copyright information to certain messages. You can add a selected annotation to the start or end of the message body.

  You can also prevent duplicating a message annotation by selecting If already present: Do not insert annotation.

  To create a new annotation, select (Create a new annotation) from the Annotation to Use drop-down menu and Save your changes. The annotation is displayed as Add the 'Annotation for '[content rule name]' annotation...'. Click the annotation name to modify the details.

• Strip the Attachment

  The Strip the Attachment action removes an attachment and can be applied to the following content rules:

  • Analyze Properties
  • Check Registered Data
  • Detect Active Content
  • Detect Filenames
  • Detect Lexical Expression
  • Detect Malformed Data
  • Detect Media Types
  • Detect Virus
  • Redact Text (on unsuccessful redaction only)
  • Run External Command
  • Sanitize Active Content (on unsuccessful sanitization only)
  • Sanitize Document Content (on unsuccessful sanitization only)
  • Structural Validation

  You can only add one Strip the Attachment action to a content rule.

  You can also apply a message annotation to the start or end of the successfully stripped message. For example, you might want to add an annotation that notifies the recipient that an attachment has been removed.

  To create a new annotation, select (Create a new annotation) from the Annotation to Use drop-down menu and Save your changes. The annotation is displayed as Add the 'Annotation for '[content rule name]' annotation...'. Click the annotation name to modify the details.

• Add a Message Header

  You can add any number of headers to a detected message using the Add a Message Header action. Message Headers are configured in two parts:

  Header name: Value

  The specified value can include supported tokens. See Using Tokens for more information.

  You must not add a colon (:) to the Header name.

  You cannot apply an Add a Message Header action to either the Message Processing Fails or Message Modification Failscontent rule.

• Copy to Message Area

  The Copy to Message Area action sends a copy of a detected message to a specified message area. See Creating a Disposal Action for information on creating a new message area. You can only apply a Copy to Message Area action to an Archive to Server content rule.

  This action is not designed for long term message archiving. If you select a message area that has an expiry period, the Gateway will delete messages copied to this message area after this period expires. If you apply a Copy to Message Area action and also set a disposal action to hold messages in a different message area, you will have two copies of the same message. If you delete the message from one message area, it still remains in the other.

See also...

• Content Rules
• Disposal Actions
• Primary Actions
• About Informs
• Message Annotations
• Alert Settings
• Using Tokens

© 1995–2018 Clearswift Ltd.