cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2393
Views
0
Helpful
0
Replies

ESA/Ironport regular expressions

geggart-dd
Level 1
Level 1

Hi folks,

 

Am trying to write a regex for the content filter for outbound mail that looks at the content of the message to determine if we need to block/quarantine it.

 

(NOTE: our regex is also using near parameters i.e. words near others...)

 

Things are working if we use hardcoded words/values in the search string.

/building\W+(\w+\W+){0,2}?construction industry payments/gi

/(bcip|b c i p)\W+(\w+\W+){0,2}?act.*/gi

 

If we then use a search for items like industry* or other fields where we only search using wildcards it does not work...

(?i)building\W+(\w+\W+){1,2}?((?i)construct.*\W+(\w+\W+){1,1}?industr.*\W+(\w+\W+){1,1}?pay.*\W+(\w+\W+){1,1}?act.*))

 

 

any ideas on this/help would be appreciated

 

Regards

 

 

 

0 Replies 0