Creating and configuring a filter action

Administrator Help | TRITON AP-EMAIL | Version 8.2.x

You can add a filter action and configure its properties on the Main > Policy Management > Actions page. Click Add to open the Add Action page and enter an action name.

In the Used by drop-down list, select the policy type for which this action can be used: Email or Data. Your selection here determines which action properties are available when you create the action.

Email policy action options include:

Deliver message (default)

Resume processing

Drop message

DLP policy action options include:

Deliver message (default)

Drop message

The deliver message option includes the same action properties for both email and DLP actions. However, in some cases, their behavior for an email policy action and a DLP policy action in a single appliance/single cluster network is different from that for a DLP policy action that is created in a multiple appliance/multiple cluster environment.

Deliver message

Select Deliver message when you want an email message delivered to its intended recipient. This option is the default selection for both an email policy action and a DLP action.

If you choose this option, you can also define the following message delivery options:

Enable header modification. Mark this check box to open a set of header modification condition entry fields. Options include the following:


Condition	Parameters
Add or rewrite header value	Header name, To value
Remove header	Header name
Remove header if condition matches	Header name, If header contains the value
Find and replace header value	Header name, Find, Replace with
Add or append to header value	Header name, Add/append value
Add or prepend to header value	Header name, Add/prepend value

Click the icons at the end of each condition line to delete the current header modification condition or to add a new condition below the current condition.

Bcc the original unanalyzed message to. Enter at least 1 email address to which you want a blind copy of the unanalyzed message sent, for example, the email system administrator. Separate multiple email addresses with a semicolon.

Delay message delivery until. Specify a day and time for a delayed message delivery. You may select this option if you want to delay the delivery of a message for some reason, for example, to send a large volume of marketing email at a time of low corporate email activity. This action option is recommended for use with a Custom Content filter in a policy rule. See Custom content for information about a custom content filter.

Use IP address. Specify an appliance IP address from the drop-down list for message delivery. Only standalone appliances are included in the IP address list.


	Note This option is available for a DLP action being created in a multiple standalone appliance environment. The default setting is the appliance E1 or P1 interface. This setting may be customized for each standalone appliance.

The IP addresses in the list are configured in the Forcepoint appliance. (See the Forcepoint Appliance Manager Help or Using the X-Series Command Line Interface (CLI) for information.)

This feature is useful if you want to route a large volume of outbound email. This action option is recommended for use with a Custom Content filter in a policy rule. See Custom content for information about a custom content filter.

Deliver email messages based on domain-based route. Specify message delivery via a defined domain-based route. Select the desired route from the drop-down list. You can also modify the selected route by clicking Edit Route.


	Note This option is available for a DLP action being created in a multiple appliance/multiple cluster environment. The default setting is the domain-based route (Settings > Inbound/Outbound > Mail Routing). Change the default setting by selecting Add Domain Based Route in the drop-down list. This setting may be customized for each appliance.

Save the original message to a queue. Send the message to a specified message queue for further processing. Select the Add Queue option to add a new queue for this filter action.


	Note This option is available for a DLP action being created in a multiple appliance/multiple cluster environment. The default setting is data-security. Change the default setting by selecting Add Queue. This setting may be customized for each appliance.

Personal Email Manager portal options. This option is enabled only when the Save the original message to a queue option is marked. Specify how the queued message is handled in the Personal Email Manager end-user facility by selecting 1 of the following:

View and manage message. Allow the end user to view the message and perform any action available in the Personal Email Manager end-user tool.

Do not show. Ensure the message does not appear in the Personal Email Manager end-user portal.

Message log only. Pertinent information about the message appears in the Personal Email Manager end-user portal, but the end user has only limited access. The user cannot view message content; deliver, download, or forward the message; or add the address to the personal Always Block or Always Permit lists.

Resume processing

Select Resume processing when you want to continue message analysis using the next filter in sequence if the current filter is triggered (for example, after a URL match is detected in a message). If this option is the final triggered filter's action, the message is delivered.

Additional message action options are the same as for message delivery.

Drop message

Select Drop message when you want to delete a message without delivering it to its intended recipient. This option is available for both email and DLP policy actions.

You can forward a dropped message by marking the Forward to option and entering at least 1 email address.

You can also configure the Save the original message to a queue option to send the message to a specified message queue for further processing. Marking this check box enables the Personal Email Manager portal options described for the message delivery filter action.


	Note This option is available for a DLP action being created in a multiple appliance/multiple cluster environment. The default setting is data-security. Change the default setting by selecting Add Queue. This setting may be customized for each appliance.

Drop attachment

Select Drop attachment if you want to remove an attachment from an email message as part of the policy action. This option is available only for DLP policy actions.

Send notification

The Send notification option is available for configuring a predefined notification about an email sent to specified recipients. The notification contains the following components:

Sender. Identify the notification message sender, from among the following options:

Original email sender

Administrator (default). If you use this option, you must configure a valid administrator email address in the Settings > General > System Settings page (see Setting system notification email addresses).

Custom. If you choose this option, you can designate only 1 sender address.

Recipient. Identify the notification message recipient, from among the following options:

Original email sender

Original email recipient

Administrator. If you use this option, you must configure a valid administrator email address in the Settings > General > System Settings page (see Setting system notification email addresses).

Custom. If you choose this option, you can designate 1 or more recipient addresses, separated by semicolons.

Subject. Enter the subject that you want to be displayed when the notification is received.

Content. Enter the text that you want to be displayed in the notification message body.

Attachment. Specify whether you want to include the original message as an attachment to the notification message. Select from among the following:

Do not attach message (default)

Attach original unanalyzed message

Attach analyzed message