What To Look For? clauses

What To Look For? clauses look for conditions that must be met to trigger a content rule.

If a content rule contains multiple clauses, a message (or web traffic) must meet all the conditions defined by all the clauses to trigger the content rule. This topic contains a brief overview of all the What To Look For? clauses the Gateway uses in content rules.

What to Look For?

• Always Trigger the Rule

  The Always Trigger the Rule clause specifies that the content rule must always be triggered.

  You cannot edit this clause.

• Analyze Properties

  The Analyze Properties clause looks for a Document Properties expression list in attached files and documents. These lists match specific string values with specific document properties. See About Document Properties for more information.

  The Analyze Properties clause is used in the Analyze Properties content rule template.

• Attachments

  The Attachments clause enables you to remove attachments using the Sanitize Message content rule. If you select the Remove Attachments check box, any attachments in detected messages will be removed.

  Attachments applies to the Sanitize Message content rule.

• Bypass Rule

  The Bypass Rule clause enables you to bypass sanitization or redaction on a content rule for any signed document. Sanitization or redaction will not be attempted on signed documents if the Bypass Rule for signed documents check box is selected.

  Bypass Rule applies to the following content rules:

  • Redact Text
  • Sanitize Active Content
  • Sanitize Document Content

  Bypass Rule only affects signed documents. The Gateway will continue to apply unsuccessful redaction to signed messages, even when this check box is selected.

• Classification Level

  The Classification level specifically relates to values that are assigned to items that have been registered on an IG Server.

  The disposal action will trigger where content passing through the Gateway is matched to content registered on the IG Server, and where the Classification level for the item as set on the IG server is equal or exceeds the level set on the Gateway.

  If this value is set to 0 on your Gateway, matches to any IG registered items will trigger the disposal action.

  The Classification LevelThe Classification Level specifically relates to values that are assigned to items that have been registered on an IG Server. The disposal action will trigger where content passing through the Gateway is matched to content registered on the IG Server, and where the Classification level for the item as set on the IG server is equal or exceeds the level set on the Gateway. If this value is set to 0 on your Gateway, matches to any IG registered items will trigger the disposal action. clause is used in the Check Registered Data content rule template.

• Cryptographic Failure

  The Cryptographic Failure clause looks for instances where encryption or decryption has failed.

  You can configure the clause to trigger:

  • If a message cannot be encrypted

  • If a message cannot be decrypted

  The Cryptographic Failure clause is used in the Encryption or decryption fails content rule template.

• Detect Malformed Data

  The Detect Malformed Data content rule enables you to handle messages that include malformed data. For example, you might want to hold any messages containing a PDF attachment identified as containing malformed data. This enables you to review those messages and then release or reject them at a later time.

  The Detect Malformed Data content rule operates on selected Media Types. You can exclude or include certain types (such as PDF) using a combination of Detect Malformed Data content rules.

• Digital Signature Validation

  The Digital Signature Validation clause looks for digital signatures. You can configure the clause to look for instances where:

  • The transaction Does not have a digital signature
  • All the digital signatures are valid
  • At least one digital signature is valid

  • There is an issue with a digital signature.

    You can specify the clause to look for the conditions where the Signature is NOT valid and/or the Signature is unknown.

• Document Contents

  The Document Contents clause looks for meta data included in documents detected by a Sanitize Document Content rule. You can configure the rule to search for:

  • Previous revision history
  • Comments

• Document Properties

  The Document Properties clause looks for information contained in the meta data of an attachment or document. You can use this clause to scan a file for user information, revision history, subject matter or any custom document properties belonging to a file.

  For more information, refer to Document Properties clause.

• Images

  The Images clause specifies if you wish the system to remove possible embedded data from images in supported file types, such as data encoded using steganographic techniques.

  It is impossible to accurately detect the existence of embedded data - for this reason, all images are always sanitized when this feature is active - for example, reprocessing a modified message will trigger a further image sanitization pass.

  Image sanitization is disabled by default, but when activated:

  • The system attempts to remove potential embedded data from the following types of image - BMP, GIF, JPEG, PBM, PCX, PGM, PICT, PNG, PPM, and TIFF.
  • Imperceptible modifications are made to all such images that pass through the system.

• Lexical Expression

  The Lexical Expression clause looks for words, phrases or specified Lexical Expressions. The clause uses Lexical Expression Lists as a reference and can be used to detect phrases that violate your security policy.

  For more information, refer to Lexical Expression clause.

• Malware Outbreak Detection

  The Malware Outbreak Detection clause identifies messages that potentially contain malware. You can Enable Detection on a Detect Virus content rule. You can then configure the content rule to discard or hold the message in a message area.

  This feature is only available on the Clearswift Secure Email Gateway. If you are using a SEG Lite that does not provide an anti-virus product, you can still use this feature.

• Message has Failed to be Modified

  The Message has Failed to be Modified clause looks for messages which have failed to be modified by the Gateway. The content rule then automatically applies the What to Do actions to those messages.

  You cannot edit this clause.

• Message has Failed to be Processed

  The Message has Failed to be Processed clause looks for messages which have failed to be processed by the Gateway. The content rule then automatically applies the What to Do actions to those messages.

  You cannot edit this clause.

• Message Size Restriction

  The Message Size Restriction clause detects messages that violate a specified size limit.

  You can:

  • Configure a size limit between 0 and 2,097,150 KB (2.1 GB)

  • Configure the size limit as either a maximum or a minimum value. For example, applying a restriction of 1,000,000 KB or more detects messages smaller than 1 GB.

• Missing Manager Detection

  The Missing Manager Detection clause looks for messages that have been sent without the sender's manager in the list of recipients. You can configure the clause to ignore exceptions. For more information, refer to Missing Manager Detection.

• Mode

  The Mode clause enables you to specify the mode of operation used by the Sanitize Message content rule. You can select either:

  • Detect only
  • Detect and sanitize

  Mode applies to the Sanitize Message content rule.

• HTML and RTF Email Bodies

  The HTML and RTF Email Bodies clause looks for content in rich text or HTML in a message body. You can select whether you want to convert rich text into plain text, or search for specific threats in the message body, such as embedded images, active content or links to other resources.

  HTML and RTF Email Bodies applies to the Sanitize Message content rule.

• Restrict the Number of Attachments

  The Restrict the Number of Attachments clause looks for messages which include more than a specified number of attachments. You can restrict the number of attachments to a number between 0 and 100. For example, if you configure the value to 5, the clause looks for messages with 6 or more attachments.

  The Restrict the Number of Attachments Clause is used in the Attachment Count Restriction content rule template.

• Run External Command

  The Run External Command clause looks for details of the executable program that the Gateway is to run. See Run external command content rule for more information on this clause.

• Scan text extracted from images (OCR)

  Scan text extracted from images (OCR) enables you to use the Clearswift Secure Email Gateway inbuilt OCR (Optical Character Recognition) technology to scan text that has been extracted from an image.

  You can apply OCR to a selection of languages. English, French, Spanish, and German are enabled when you first upgrade or install. We recommend using as few languages as possible to maximize the processing performance and accuracy of text scanning.

  You can also configure the minimum and maximum image sizes that will be processed by the Gateway when scanning extracted text.

  See Advanced for more information on image sizes and adding or removing languages.

• Size Restriction

  The Size Restriction clause detects files that violate a specified size limit.

  The Size Restriction clause is often used in conjunction with the Which Media Types clause. For example, you can create a Detect media types content rule that detects large image files.

  You can:

  • Configure a size limit between 0 and 2,097,150 KB (2.1 GB)

  • Configure the size limit as either a maximum or a minimum value. For example, applying a restriction of 1,000,000 KB or more detects files smaller than 1 GB.

• Spam Detection

  The Spam Detection clause uses SpamLogic to look for indicators of spam contained in a message. Spam Logic uses several methods to detect spam.

  You can configure the clause to trigger when spam is detected by any of the following methods:

  • Bad reputation returned by TRUSTmanager
  • Real-time IP Blocklist
  • Spoof Detection
  • BATVBounce Address Tag Validation Address Validation
  • DMARCDomain-based Message Authentication, Reporting & Conformance Reject

  • DMARC Quarantine

  • SPFSender Policy Framework Hard Fail
  • SPF Soft Fail
  • DKIMDomainKeys Identified Mail Hard Fail
  • DKIM Soft Fail
  • Confirmed Junk Email
  • Suspected Junk Email

• Unacceptable Images

  The Unacceptable Images clause looks for messages that are classified as unacceptable by ImageLogic.

  ImageLogic rates the acceptability of each image it scans by assigning it a score based on its content. Higher scores are considered to be less acceptable than lower scores. Images scoring higher than the threshold value you've set are considered unacceptable and the appropriate action (typically quarantine) is applied by the content rule.

  For more information, refer to Unacceptable Images clause.

• URLs and Hyperlinks

  The URLs and Hyperlinks clause looks for specific URLs or hyperlinks to URLs. You can specify a selection of URL Lists to search for, and exclude any URLs that are known to be trusted. For more information, refer to URLs and Hyperlinks clause.

• Virus Detection

  The Virus Detection clause searches for viruses in a message using virus types.

  You cannot edit this clause.

• Which Media Types

  The Which Media Types clause looks for selected media types. You can use a Which Media Types clause to look for types of file (for example, documents or images) or file extensions. For more information, refer to Which Media Types clause.

• Which Message Types

  The Which Message Types clause looks for potentially harmful message types, such as phishing, suspected spam, or newsletters. This clause is used in the Sanitize Message content rule, and can be configured to apply to All messages or Selected messages.

• With a Filename of...

  The Filename clause looks for specific filenames using pre-configured Filename Lists. Filename Lists consist of filename identifiers you might want the Gateway to intercept using this clause.

  Content rules created from a Detect Media Types or Detect Filename template. You can specify whether the rule will trigger if the filenames are detected or if they are not detected.

  To find out more about creating or modifying a list of filenames, see the topic Filename Lists.