ANNOUNCEMENT - The community will be down for maintenace this Thursday August 13 from 12:00 AM PT to 02:00 AM PT. As a precaution save your work.
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
204
Views
5
Helpful
1
Replies
Highlighted
Beginner

ESA Content filter

Hi I'm new to regex.

How to add a condition in a filter to block emails with similar text in the subject:

Nancy Reardon sent you "PO-09507.pdf"

Andrew Beverley sent you "PO-124.pdf"

larry noble sent you "PO-110.pdf"

Tony Flinn sent you "PO-09522.pdf"

 

1 REPLY 1
Highlighted
Participant

Re: ESA Content filter

Hi there,

 

to answer your question I would point you to one of the best regex sites to help you defining querys.

Check out : https://regex101.com/r/7C7YsR/1 to get some ideas.

 

I personally would create a content filter checking for two components :

textblock in subject : "sent you"

pdf as file attachment

 

The filter would be like:

 

CheckforBadPDFv1: if (body-contains("sent you", 1)) AND (attachment-filetype == "pdf")

                               { quarantine("Policy"); }

 

I hope that helps, be aware that this might also catch valid messages shared from O365 with a PDF

 

-Marc