Configuring rule actions

ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

Configuring rule actions

book

Article ID: 181329

calendar_today

Updated On:

Products

Mail Security for Microsoft Exchange

Issue/Introduction

Resolution

You can specify the action that you want Mail Security to take when a violation occurs.

Mail Security provides the following options for processing messages that trigger content filtering rule violations:

Delete entire message
Delete attachment/message body and replace with text
You can customize the replacement text.
Quarantine entire message and replace with text
You can customize the replacement text.
Quarantine attachment/message body and replace with text
You can customize the replacement text.
Add tag to beginning of subject line
You can customize the text that you want to prepend the subject line. This rule action is not available if you apply the rule to the internal messages (store).
Log only
See About logging events

You can also configure Mail Security to add one or more X-headers to messages that violate the content filtering rule. Mail Security provides five default X-headers from which you can choose. Mail Security also lets you create your own X-headers. You can specify up to 25 X-headers for each violation.

See About applying X-headers to messages for archiving

To configure rule actions to delete the message

In the console on the primary navigation bar, click Policies.
In the sidebar under Content Enforcement, click Content Filtering Rules.
Do one of the following:
Create a rule
In the sidebar under Tasks, click New rule.
Modify an existing rule
In the content area, double-click the rule that you want to edit.
On the Actions tab, in the When a violation occurs box, use the drop-down menu to select Delete entire message.
The default setting is: Quarantine entire message and replace with text.
Do any of the following:
- Configure the remaining components of the content filtering rule.
  See Configuring the conditions of a content filtering rule
  See Specifying the users and groups to which the rule applies
  See Specifying who to notify if a content filtering rule is violated
- Click OK and then click Deploy Changes.
  See Deploying settings and changes to a server or group

To configure rule actions to delete the attachment and message body and replace with text

In the console on the primary navigation bar, click Policies.
In the sidebar under Content Enforcement, click Content Filtering Rules.
Do one of the following:
Create a rule
In the sidebar under Tasks, click New rule.
Modify an existing rule
In the content area, double-click the rule that you want to edit.
On the Actions tab, in the When a violation occurs box, use the drop-down menu to select Delete attachment/message body and replace with text.
The default setting is: Quarantine entire message and replace with text.
In the Replacement text box, type your customized text.
The default text is: Symantec Mail Security replaced %attachment% with this text message. The original attachment content type was not allowed and was %action%.
See Alert and notification variables