cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
831
Views
0
Helpful
5
Replies
trdavis
Beginner

Content filter block acronym but not all words containing acronym letters

I've setup a filter to block an acronym but don't want to block all words that contain the acronym letters. Is this possible?

Example:  block subject containing the acronym LAN but not the words land or ambulance. 

Thanks. 

2 ACCEPTED SOLUTIONS

Accepted Solutions
Ken Stieers
Engager

You can use a regex there.

try this:    '\bLAN\b'

View solution in original post

Mathew Huynh
Cisco Employee

Hey Trdavis,

If you're using the content dictionaries, ensure to check "Match Whole Words"

Else it's also suggested to use the boundary regex as Ken has provided \bWORD\b

Regards,

Matthew

View solution in original post

5 REPLIES 5
Ken Stieers
Engager

You can use a regex there.

try this:    '\bLAN\b'

View solution in original post

Thanks to you both, using a regex did the trick.

Mathew Huynh
Cisco Employee

Hey Trdavis,

If you're using the content dictionaries, ensure to check "Match Whole Words"

Else it's also suggested to use the boundary regex as Ken has provided \bWORD\b

Regards,

Matthew

View solution in original post

what if the word used in the dictionary, and still mail are blocked due to reading half word from the mail body.

 

Example:

Word in the dictionary is : ASS

 

in the mail word used is Assembly

 

How can we stop this

Hi, 

As suggested by Mathew above, if you check "Match whole words" in the Dictionary filter will match exact word in the email.

Example Stated By You:

I have attached the Dictionary created with word "Ass".

When i type "Assembly" in the email, filter is not triggered.

Wed Aug 7 20:28:43 2019 Info: MID 6134 interim verdict using engine: CASE spam negative
Wed Aug 7 20:28:43 2019 Info: MID 6134 using engine: CASE spam negative
Wed Aug 7 20:28:43 2019 Info: MID 6134 interim AV verdict using McAfee CLEAN
Wed Aug 7 20:28:43 2019 Info: MID 6134 interim AV verdict using Sophos CLEAN
Wed Aug 7 20:28:43 2019 Info: MID 6134 antivirus negative
Wed Aug 7 20:28:43 2019 Info: MID 6134 AMP file reputation verdict : SKIPPED (no attachment in message)
Wed Aug 7 20:28:43 2019 Info: MID 6134 using engine: GRAYMAIL negative
Wed Aug 7 20:28:43 2019 Info: MID 6134 Outbreak Filters: verdict negative
Wed Aug 7 20:28:43 2019 Info: MID 6134 queued for delivery

 

But when I type the exact word "Ass", email is held by filter created.

Wed Aug 7 20:29:04 2019 Info: MID 6135 interim AV verdict using McAfee CLEAN
Wed Aug 7 20:29:04 2019 Info: MID 6135 interim AV verdict using Sophos CLEAN
Wed Aug 7 20:29:04 2019 Info: MID 6135 antivirus negative
Wed Aug 7 20:29:04 2019 Info: MID 6135 AMP file reputation verdict : SKIPPED (no attachment in message)
Wed Aug 7 20:29:04 2019 Info: MID 6135 using engine: GRAYMAIL negative
Wed Aug 7 20:29:04 2019 Info: MID 6135 Custom Log Entry: Ass
Wed Aug 7 20:29:04 2019 Info: MID 6135 Outbreak Filters: verdict negative
Wed Aug 7 20:29:04 2019 Info: MID 6135 enqueued for transfer to centralized quarantine "Policy" (content filter Test_Words)
Wed Aug 7 20:29:04 2019 Info: MID 6135 queued for delivery

 

I hope this clarifies your query.

 

Rgds,

Gagan

Content for Community-Ad