Managing filter actions

Administrator Help | TRITON AP-EMAIL | Version 8.2.x

A filter action determines a message's final disposition. The email protection software analyzes messages and their attachments, and then performs an action based on applicable policy settings. Actions are created in the Main > Policy Management > Actions page. You can add a defined action to a policy rule when you configure your email policies.

In addition to defining an action used in an email policy, you can create an action for use in an email DLP action plan in the Data module. See Data Security Manager Help for information about DLP action plans.

For most network configurations (i.e., single standalone appliance or single appliance cluster), the property settings available for creating an action for an email DLP policy are the same as those for a policy action configured for the email protection software. However, if your network includes multiple standalone appliances or multiple clusters, the DLP policy action settings available when an action is initially created are limited. Unless otherwise noted, the following procedures apply to both email and DLP policy actions.

Create a new filter action by clicking Add and selecting action properties (see Creating and configuring a filter action).

You can remove a filter action by marking the check box to the left of the filter name to select it and clicking Delete. You can delete a filter action only if its current status is Not referenced, which means that the action is not currently used in a policy rule or action plan. A filter action that is currently referenced by a filter or action plan does not have a check box for selection. You cannot remove a default email filter action.

The following default actions are available:

Virus. Drop the filtered message and save the original message to the virus queue. Allow a Personal Email Manager end user to view and manage the message.

URL Analysis. Drop the analyzed message and save the original message to the spam queue. Allow a Personal Email Manager end user to view and manage the message.

Spam. Drop the analyzed message and save the original message to the spam queue. Allow a Personal Email Manager end user to view and manage the message.

Commercial Bulk. Deliver the analyzed message and add "COMMERCIAL:" to the message subject. Allow a Personal Email Manager end user to view and manage the message.

Advanced File Analysis. Drop the analyzed message and save the original message to the virus queue. Send a notification message without attaching the original email to the original email sender.