Creating and configuring a filter action

Administrator Help | Forcepoint Email Security | Version 8.5.x

Add a filter action and configure its properties on the page Main > Policy Management > Actions.

Add a new filter action

Click Add.

The Add Action page displays.

In the text field Action Name, enter a name for the action.

From the pull-down menu Used by, select the policy type for which this action can be used: Email or Data.

Your selection determines which action properties are available when you create the action.

Email policy action options include:

DLP policy action options include:

The Deliver Message option includes the same action properties for both email and DLP policy actions. However, in some cases, the behavior for an email policy action and a DLP policy action in a single appliance/single cluster network is different from that for a DLP policy action that is created in a multiple appliance/multiple cluster environment.

Configure message delivery options

Click Add.

The Add Action page displays.

In the text field Action Name, enter a name for the action.

From the pull-down menu Used by, select the policy type for which this action can be used: Email or Data.

From the pull-down menu Action taken when a message triggers a filter, select Deliver Message.

Selection indicates to deliver an email message to its intended recipient. This option is the default selection for both an email policy action and a DLP policy action.

Define the following message delivery options:

Enable header modification. Mark this check box to open a set of header modification condition entry fields. Options include the following:


Condition	Parameters
Add or rewrite header value	Header name, To value
Remove header	Header name
Remove header if condition matches	Header name, If header contains the value
Find and replace header value	Header name, Find, Replace with
Add or append to header value	Header name, Add/append value
Add or prepend to header value	Header name, Add/prepend value

Click the icons at the end of each condition line to delete the current header modification condition or to add a new condition below the current condition.

Bcc the original unanalyzed message to. Enter at least one email address to which to send a blind copy of the unanalyzed message; for example, the email system administrator. Separate multiple email addresses with a semicolon.

Delay message delivery until. Specify a day and time for a delayed message delivery. You may select this option to delay the delivery of a message for some reason, for example, to send a large volume of marketing email at a time of low corporate email activity. This action option is recommended for use with a Custom Content filter in a policy rule. See Custom content.

Use IP address. Specify an appliance IP address from the pull-down menu for message delivery. Only standalone appliances are included in the IP address list.


	Note This option is available for a DLP action being created in a multiple standalone appliance environment. The default setting is the appliance E1 or P1 interface. This setting may be customized for each standalone appliance.

The IP addresses in the list are configured in the Forcepoint appliance. (See the Forcepoint Appliances Getting Started Guide or Forcepoint Appliances Command Line Interface (CLI) Guide for information.)

This feature is useful for routing a large volume of outbound email. This action option is recommended for use with a Custom Content filter in a policy rule. See Custom content.

Deliver email messages based on domain-based route. Specify message delivery via a defined domain-based route. Select the desired route from the pull-down menu. You can also modify the selected route by clicking Edit Route.


	Note This option is available for a DLP action being created in a multiple appliance/multiple cluster environment. The default setting is the domain-based route (Settings > Inbound/Outbound > Mail Routing). Change the default setting by selecting Add Domain Based Route in the pull-down menu. This setting may be customized for each appliance.

Save the original, unanalyzed message to a queue. Send the message to a specified message queue for further processing. Select the Add Queue option to add a new queue for this filter action.


	Note This option is available for a DLP action being created in a multiple appliance/multiple cluster environment. The default setting is data-security. Change the default setting by selecting Add Queue. This setting may be customized for each appliance.

Personal Email Manager portal options. This option is enabled only when the option Save the original message to a queue is marked. Specify how the queued message is handled in the Personal Email Manager end-user portal by selecting one of the following:

View and manage messages. Allow the end user to view the message and perform any action available in the Personal Email Manager end-user tool.

Do not display. Ensure the message does not appear in the Personal Email Manager end-user portal.

Message log only. Pertinent information about the message appears in the Personal Email Manager end-user portal, but the end user has only limited access. The user cannot view message content; deliver, download, or forward the message; or add the address to the personal Always Block or Always Permit lists.

(DLP only) Mark the check box Drop attachment.

Select this option to remove an attachment from an email message as part of the policy action. Only available for DLP policy actions.

(Optional) Mark the check box Send notification.

Use this option to configure a notification message to be sent regarding the delivered email.

Configure the following notification message settings:

Sender. Identify the notification message sender, from among the following options:

Original email sender.

Administrator (default). If you use this option, you must configure a valid administrator email address on the page Settings > General > System Settings (see Setting system notification email addresses).

Custom. If you choose this option, you can designate only one sender address.

Recipient. Identify the notification message recipient from among the following options:

Original email sender.

Original email recipient.

Administrator. If you use this option, you must configure a valid administrator email address on the page Settings > General > System Settings (see Setting system notification email addresses).

Custom. If you choose this option, you can designate one or more recipient addresses, separated by semicolons.

Subject. Enter the subject to be displayed when the notification is received.

Content. Enter the text to be displayed in the notification message body.

Attachment. Specify whether to include the original message as an attachment to the notification message. Select from among the following:

Do not attach message (default)

Attach original unanalyzed message

Attach analyzed message

Click OK.

The settings are saved.

Resume processing

Use the Resume Processing option when you want to continue message analysis using the next filter in sequence if the current filter is triggered (for example, after a URL match is detected in a message). If this option is the final triggered filter's action, the message is delivered.

Additional message action options are the same as for message delivery.

Configure message processing options

Click Add.

The Add Action page displays.

In the text field Action Name, enter a name for the action.

From the pull-down menu Used by, select the policy type for which this action can be used: Email or Data.

From the pull-down menu Action taken when a message triggers a filter, select Resume Processing.

Selection indicates to deliver an email message to its intended recipient. This option is the default selection for both an email policy action and a DLP policy action.

Additional message action options are the same as for Deliver message; configure the options as needed.

Click OK.

The settings are saved.

Drop message

Use the Drop Message option to delete a message without delivering it to its intended recipient. This option is available for both email and DLP policy actions.

Configure dropped message actions

Click Add.

The Add Action page displays.

In the text field Action Name, enter a name for the action.

From the pull-down menu Used by, select the policy type for which this action can be used: Email or Data.

From the pull-down menu Action taken when a message triggers a filter, select Drop Message.

Selection indicates to delete a message without delivering it to the intended recipient.

Forward the dropped message; mark the check box Forward to and enter at least one email address in the text field.

Send the dropped message to a queue for further processing; mark the check box Save the original, unanalyzed message to a queue and select the desired queue from the pull-down menu.

Marking this check box enables the Personal Email Manager portal options. Specify how the dropped message is handled in the Personal Email Manager end-user portal by selecting one of the following:

View and manage messages. Allow the end user to view the message and perform any action available in the Personal Email Manager end-user tool.

Do not display. Ensure the message does not appear in the Personal Email Manager end-user portal.


	Note This option is available for a DLP action being created in a multiple appliance/multiple cluster environment. The default setting is data-security. Change the default setting by selecting Add Queue. This setting may be customized for each appliance.