Adding a rule

Administrator Help | Forcepoint Email Security | Version 8.5.x

A policy rule comprises the filter applied to a message that matches a policy's sender/recipient conditions and the action taken when that message triggers the filter. The following default rules are available:

Antivirus rule uses the default virus filter and virus default filter action.

Email Attachment rule uses the default email attachment filter and email attachment default filter action.

Antispoof rule uses the default spoofed email filter and spoof default filter action.

URL Analysis rule uses the default URL analysis filter and URL analysis default filter action.

You can configure multiple URL Analysis rules to use settings other than the defaults. See URL analysis and Managing filter actions.

Antispam rule uses the default spam filter and spam default filter action.

Commercial Bulk rule uses the default commercial bulk email filter and commercial bulk default filter action.

Advanced File Analysis rule uses the default advanced file analysis filter and advanced file analysis default filter action.

Disclaimer rule uses the default disclaimer filter.

You may create a new rule in combination with the following filter types:

From the section Rules on the page Add or Edit Policy, click Add.

The Add Rule page displays.

In the field Rule Name, enter a name for the rule.

From Status, select the desired policy status, Enabled or Disabled.

The default is Enabled.

From the pull-down menu Order, select the order in which the rule should apply.

By default, a new rule is created in the first position. The Disclaimer rule is always applied last.

In the section Filter, from the pull-down menu Filter name, select a predefined filter type or click Add filter.

If you select Add filter, the Add Filter page displays to define a new filter. See Creating and configuring a filter.

In the section Action, from the pull-down menu Action name, select a default filter action or click Add action.

If you select Add action, the Add Action page displays to define a new action. See Creating and configuring a filter action.

(Optional) From the section Action, click Edit.

The Edit Action page displays.

(Optional) In the section Filter Bypass Condition, click Add.

The Add Filter Bypass Conditions page displays. Create filter bypass entries in the Sender Email Addresses, Recipient Email Addresses, and IP Address Groups sections in one of the following ways:

Add a predefined email address list; click Browse next to the Email Address File field and navigate to the desired text file. The file format should be one email address per line, up to a maximum of eight addresses.

Enter an individual email address in the Email address field. Click the right arrow button to add the individual entry to the Email Address List on the right.

Select the IP address groups you want to bypass analysis, and click the arrow button to add them to the Added IP Address Groups box. You can also define a new IP address group on this page if desired.

Use an asterisk (*) in an address as a wildcard.

Delete an entry in an Email Address List; select it and click Remove.

Export and save an address list as a text file; click Export All.

Click OK to save your bypass entries.

You cannot use these settings to bypass a custom content filter.

Click OK.

The rule is saved and displays in the Rules section of the Edit Inbound Policy page.

Use the buttons Move Up and Move Down to adjust rule order.

Editing rules

Use the page Add (or Edit) Policy > Edit Rule to define what happens to an email message that matches the sender/recipient conditions and triggers the policy. This page contains the filter and filter action that currently define the rule that you clicked. You can also define message sender/recipient conditions that, when met, allow a message to bypass the filter.

From the section Rules on the page Add or Edit Policy, click a rule name.

The Edit Rule page displays.

On the Edit Rule page, configure the following options:

Status: Enabled or disabled.

Filter properties. Click Edit to open the Edit Filter page.

See Creating and configuring a filter.

Action options. Click Edit to open the Edit Action page.

See Creating and configuring a filter action.


	Note Any change you make to existing rule components will be reflected in the filter and action definitions you configured on the pages Main > Policy Management > Filters and Main > Policy Management > Actions. The changes are not unique to the individual policy.

Filter bypass conditions. See Adding a rule.

Click OK.

The changes are saved.