Attachment - search only in email attachments. For rules created in v8.2 or later, this includes attachment body and attachment headers. For rules created prior to v8.2, only attachment body is searched.
Subject - search only in the subject line of the email message
Body - search only in the main body of the email message
From - search only in the From field of the email message
To - search only in the To field of the email message
Cc - search only in the carbon copy field of the email message
Bcc - search only in the blind carbon copy field of the email message
Other header - search in headers that are not covered by the above options.
All headers - Search in all headers not covered in the above options. This includes all standard headers—such as Date, Message-ID, or Importance—as well as non-standard headers (x-headers) added during the sending of an email. Some examples of x-headers are x-mailer, x-spam-reason, and x-originating-ip.
User-defined header - Some users define their own x-headers to add custom information to the header part of email messages. For example, they might create an x-header such as "X-MyCompany: Copyright 2011 MyCompany". If you have user-defined email headers, and you'd like to search for these, enter the header name here.
