cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
300
Views
0
Helpful
2
Replies

Content filter multi-line body scanning

I have a regular expression which contains end of line characters, eg.

\S+[,.!]\s*[\r\n].+:\s*[\r\n]https.*\s*[\r\n]+Password\s\S{3}\s*[\r\n]

I want to scan the body of email with this pattern. However the body-contains rule doesn't perform multi-line matching according to the documentation.

The body-contains() rule scans the incoming email and all its attachments for a particular pattern defined
by its parameter. This includes delivery-status parts and associated attachments. The body-contains() rule
does not perform multi-line matching.

However there is another function, only-body-contains. My question is if that function does perform multi-line matching.

2 Replies 2

I'm going to bet that only-body-contains doesn't do multiline matching.
Would splitting your line up into four conditions, and requiring all of them to be matched do what you need?
Does the order matter? E.g. are your regexes generic enough that it would create false positives?

That is also my bet...

The order of the lines is important, but I can always try with an AND condition and matching all relevant lines. The initial action would be to duplicate the email to an quarantaine and watch that quarantaine for false positives.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: