ESA- Incoming content filter for sentences

[SgtD]

Folks,

Trying to setup a content filter to search the body of the email for a sentence/phrase and not having a lot of luck getting it to work. Looking to setup a filter to match on "You'll make the payment through Bitcoin" so that I can send them to a quarantine for review and deletion. I have tried setting it via condition looking in Message Body contains text and another condition contains term in content dictionary and created a dictionary that includes the phrase in it. Not having any luck getting it to match. any help appreciated.

Thanks,

-Bob

[Greg Muszynski]

I would break it down and first test by looking for just one word like "Bitcoin" then I would expand it to "make the payment through Bitcoin" I think the apostrophe in the "You'll" may be tripping you up if you are not escaping it with a backslash "You\'ll"

also have you tried running your RegEx through a Regular Exprassion checker such as:

https://regex101.com/

Also under System Administration there is a Trace utility that allows you to test what will happen to your message as it goes through the sausage maker machine, please give that a shot with the text you are searching for in the Paste Message Body section

you can also paste your actual filter here on the forum for smarter folks than me to look at 

[SgtD]

Greg,

Thanks for the response. I actually figured it out this morning with support. The filter was correct but I have a few incoming mail policies and had to add the filter to the ones that didn't inherit the settings of the default policy.

Thanks again,

-Bob