en-US
search-icon

Email Security 9.0 User Guide

Policy

Policy Management plays a key role in evaluating the email threats by filtering email based on message contents and attachments. You can create policy filters in which you specify an action or actions you want Email Security to take on messages that meet the conditions you define. For example, you can specify words to search for—a product term, for example—in content, senders, or other parts of the email. After filtering for specified characteristics, you can choose from a list of actions to apply to the message and its attachments.

Users can only define inbound filters. Outbound filters are managed by system administrators.

 
* 
NOTE: Any of the policies configured in the Policy section take precedence over any entries made in the Allowed List.
To add a new filter:
1
Navigate to Policy > Filters.

 
* 
NOTE: Outbound filters are disabled for users.
2
Select Add New Filter.

* 
NOTE: The fields in the window change based on the action you choose.
3
The Enable this Filter check box is checked by default. Deselect the check box to create rules that do not go into effect immediately.
4
Choose whether the filter matches All of the conditions or Any of the conditions
All—Causes email to be filtered only when all of the filter conditions apply (logical AND)
Any—Causes email to be filtered when any of the conditions apply (logical OR)
5
Choose the parts of the message to filter in the Select field. See the following table for more information:

Select

Definition

From

Filter by the sender’s name

To/Cc/Bcc

Filter by the names in the To, Cc, or Bcc fields

Subject

Filter by words in the subject

Body

Filter based on information in the body of the email

Subject or Body

Filter based on information in the subject and body of the email

Message Headers

Filter based on he information in the message header

Size of message

Filter messages based on the size of the message

Country Code

Filter based on sender’s country code

6
Choose the matching operation in the Matching field. The choices for matching operation vary with the message part being matched against. The following table describes the matching operations available.
 

Type

Explanation

Example

with specific word

Equivalent to “Find the whole word only”

Search for the word “Mail” from the subject line “This is Mail” will match.

Search for the word “Mail” from the subject line “This is MailFrontier” will not match.

without specific word

Not equivalent to “Find the whole word only”

 

with specific phrase

Equivalent to “Find complete phrase”

Search for the words “is Mail” from the subject line “This is Mail” will match.

Search for the words “is Mail” from the subject line “This is MailFrontier” will not match.

without specific phrase

Not equivalent to “Find complete phrase”

 

starts with

The message part being searched for should start with the search value

Search for “This” from the subject line “This is Mail” will match.

ends with

The message part being searched for should end with the search value

Search for “is Mail” from the subject line “This is Mail” will match.

is

Only the search criteria should exist (exact match)

Search for the word “Mail” from the subject line “This is Mail” will not match.

Search for “is Mail from the subject line “is Mail” will match.

is not

Only the search criteria should not exist

Search for the phrase “is Mail” from the subject line “This is MailFrontier” will match.

contains

Substring search

Search for “is Mail” from the subject line “This is Mail” will match.

does not contain

Substring search does not match

 

greater than

tests for a value greater than what is specified.

 

less than

tests for a value less than what is specified.

 

7
Enter the words or phrase that you want to filter in the Search Value text box.

If searching on a Country Code, the text field is disabled and the country code drop down menu is enabled.

8
Select the appropriate check boxes for further filtering.
Match Case—Filters a word or words sensitive to upper and lower case.
Intelligent Attachment Matching—Filters attachment names, such as .exe or .zip.
Disguised Text Identification—Filters disguised words through the sequence of its letters, for example Vi@gr@.
* 
NOTE: Disguised Text Identification cannot be used together with Match Case and can be selected only for Body and Subject message parts.
9
Click the plus sign (+) if you want to add another layer of filtering.

You can add up to 20 layers. Layers are similar to rock sifters: Each additional layer adds further screens that test email for additional conditions.

10
Choose the response action from the Action drop down list. The following table describes the available response actions:

Action

Effect

Permanently delete

The email message is permanently deleted and no further processing occurs in any SonicWall Email Security module occurs. This option does not allow the user to review the email and can cause good email to be lost.

Store in Junk Box

The email message is stored in the Junk Box. It can be unjunked by users and administrators with appropriate permissions. The user has the option of unjunking the email.

Deliver and skip Spam and Phishing analysis

The message is delivered without spam or phishing analysis.

Tag subject with

The subject of the email is tagged with a the specified term.

Strip all attachments

Remove all the attachments from the email.

Append text to message

The specified text is appended to the message body.

Reject with SMTP error code 550

 

11
Check the Stop processing policy filters box when no additional filtering is required on a message. This check box is automatically selected and grayed out when you have selected a terminal action.
12
If additional actions need to be performed on the same message, select the plus sign (+) to the right. You cannot add the same action more than once to a specific filter rule. As a result, once an action has been selected, it is not available in the drop down list for further selection within the current filter rule.
13
Type a descriptive name in the Filter Name text box.
14
In the text field, describe the Purpose of the filter.
15
Click the Save This Filter button.
To delete a filter:
1
Select the Delete button adjacent to the filter.
2
Confirm your choice when asked.