Filter
Top Products
SurfControl RiskFilter - E-mail V5.2.4 Administrator’s Guide 101
P
OLICY
M
ANAGER
Global Policy
3
Configuring the Dictionary Threshold Filter
To configure the Dictionary Threshold Filter you need to specify:
• What kind of content you want the rule to detect.
• Which parts of the e-mail message you want to scan for dictionary content.
• The dictionary score required to trigger the rule.
You can edit this filter to exactly match your company’s requirements.
To edit the filter:
1Select Global Policy from the Policy Manager tab.
2 Click Filters. The Global Policy Filter list screen is displayed.
3 Click Add . The Create New Filter screen is displayed.
4 Select the Dictionary Threshold Filter and click Next.
5 Enter a name for this filter into the Filter Name field.
6 This filter is enabled by default. Select disable if you want to switch it off.
7 If you want to make the filter so that it can be overwritten by a sub-policy change the Filter
Permission setting to writable. The default is read-only.
8 Select the check boxes that correspond to the parts of the message that you want to be checked
against the dictionary you have chosen. RiskFilter will then check the specified part/s of the message
to see if the specified words appear in it and whether the resulting threshold value is high enough to
trigger the filter:
• Mail Header – Ask RiskFilter to check the message header for the the dictionary word then specify
which part of the header you want it to check.
– Subject – the text in the ‘Subject’ field will be checked.
– From – the text in the ‘From’ field will be checked.
– To – the text in the ‘To’ field will be checked.
– Cc – the text in the ‘Cc’ field will be checked.
– Other – enter any other attribute that may appear in the header for RiskFilter to look for. For
example: enter ‘Message -Id’ for RiskFilter to scan the message-id of the header.
• Mail Body – Ask RiskFilter to check the message body for the dictionary word.
• Mail Attachment – Ask RiskFilter to check attachments for the dictionary word. You specify how
many layers within an attachment should be scanned. This is useful for looking for embedded files
such as data sheets within text documents.
9 Select the ‘Strip attachment’ check box to have the attachment removed if the filter is triggered.
10 Select the dictionary that you want to be used by the filter. Multiple dictionaries can be selected and
Check All can be used to select them all.