Dictionary entries question

[ScottLoveland8675309]

A phisher is trying to executive spoof with the title President & CEO | M&A Integration, Restructuring & Brand Repositioning

If I add that as a term in Blocked_phrases dictionary, which is used by a Blacklist filter with a rule dictionary-match("Blocked_phrases", 1), will that block messages when President & CEO | M&A Integration, Restructuring & Brand Repositioning is seen or when President & CEO, President, or CEO seen? Ideally, I'd like it to be only when the whole phrase is found. 

[Mathew Huynh · Accepted solution]

Hey Scott,

In your dictionary there is a "match whole words" check box, make sure that's ticked and it'll act as a boundary for your string to match.

From your query i assume this is at the subject line level?

IF so it'll be a subject contains dictionary match.

This means if subject contains "President & CEO | M&A Integration, Restructuring & Brand Repositioning" in this exact string pattern, it will match.

However if they added a word in between or changed a character, it will not match.

If they added an extra character/string before (separated with a whitespace) it will match.

If they added an extra character/string after (separated with a whitespace) it will match.

Keep in mind, dictionaries also accepts regex, make sure you escape the pipe | with \\

A good way to test this before you commit it into action is:

1) create dictionary

2) add dictionary to a content filter rule

3) add content filter to your policy

4) submit but DO NOT commit

5) go to system admin -> trace

Run a trace to see if it meets your requirements.

Thanks,

Mathew