How to modify the "From" header of a incoming mail

[roy78]

Hello,

For incoming mail, I would like to know on a cisco ESA if it is possible to remove part of theinformation in the "From" field.

For example, if I have the following incoming mail

"From: CEO GlobalTech <iehnamgn@ukglobaltech.com>"

I would like to have the ESA rewrite "the From" header to keep only the mail address in it and not have any display name

So it would be like:

"From: <iehnamgn@ukglobaltech.com>"

Is this possible?

Thank you for your feedback

Roy

[Ken Stieers]

It is possible via a content filter.
In the actions of the filter you could use the search and replace function.
Try this as the search string: ^.*\h(\S+@.+)$
And use $MatchedContent for the replacement

TEST THIS before applying to all of your mail flow.

[roy78]

Hello Ken, thanks for the feeback

The regex expression is good as it does well split the two parts of the From Header field

However, in the content filer rule, is this the correct way to fill in the fields according to your suggestion:

Regards,

Roy

[Ken Stieers]

Usually the ESA wants $MatchedContent, instead of $1 or $2.

If that regex is grabbing the whole thing, including the name, you may want to try this:

(\S+@.+)$

[roy78]

Hello Ken,

Thanks for the update.

The regex filter (\S+@.+)$  does the job when I test it on a string:

I updated my content filter rule in the esa to reflect it:

Howerver, mails on which the mail policy applies still have the display name in the From field of the email.

Regards,