New Content filter not functioning for incoming traffic

[kapildev]

I created new Content filter to block emails coming from specific domain - 

condition1 @- @xyz.com and

condition2 -- Subject start with ^Test 

and Action to drop such emails but it's not functioning as desired. Below is configuration detail

Login to CES

Mai Policies > Incoming Content Filters > Add Filters

Set the Filter name to CF_Test

Add Condition >> Envelope Sender - mail-from == "@xyz.com$"

Add Condition >> Subject Header - subject == "^Test for"

Select -- Apply only if all condition match

Add Action > drop

Submit

Commit

[Ken Stieers]

Did you then enable it in a policy, and is the mail hitting that policy?

[kapildev]

Yes, all policies are applied but this is not workiing as expected.

[Ken Stieers]

this is what worked for me... the domain is "contains" in the gui.

make sure you're selecting Only if all conditions match in the upper right.

[Dustin Anderson]

So, keep in mind the rules are RegEx, so if you call out starts with Test and it comes in test, it will fail cause of the capitalization.

For our system, we use Dictionaries to set the matches instead of a bunch of filters. We can pun in it full emails or domains. for your example, set your filter to ^[Tt]est

[Ken Stieers]

Adding (?i) works to make it case insensitive...

[kapildev]

This is, How I configured but does not work as expected...

[Dustin Anderson]

I would set your email trigger as ends with and the subject to contains

[kapildev]

This is fixed after I configure with contains in sender domain and subject header instead of begins with in Subject and set if all conditions applied.

Opened case with Cisco to know why it did not work with Message subject begins with...