Adding a rule

Administrator Help | Forcepoint Email Security | Version 8.4.x

A policy rule comprises the filter applied to a message that matches a policy's sender/recipient conditions and the action taken when that message triggers the filter. The following default rules are available:

Antivirus rule uses the default virus filter and virus default filter action.

Email Attachment rule uses the default email attachment filter and email attachment default filter action.

Antispoof rule uses the default spoofed email filter and spoof default filter action.

URL Analysis rule uses the default URL analysis filter and URL analysis default filter action.

You can configure multiple URL Analysis rules if you want to use settings other than the defaults. See URL analysis and Managing filter actions for more information.

Antispam rule uses the default spam filter and spam default filter action.

Commercial Bulk rule uses the default commercial bulk email filter and commercial bulk default filter action.

Advanced File Analysis rule uses the default advanced file analysis filter and advanced file analysis default filter action.

Disclaimer rule uses the default disclaimer filter.

You may create a new rule in combination with the following filter types:

Use the following steps to add a policy rule:

Click Add in the Rules section to open the Add Rule page.

Enter a name for your rule in the Rule Name entry field.

Select the desired policy status, Enabled (the default) or Disabled.

Select the order in which you want your rule applied. By default, a new rule is created in the first position. Use the Move Up and Move Down buttons to adjust rule order. The Disclaimer rule is always applied last.

Select a filter type from the Filter name drop-down list. Choose Add filter to open the Add Filter page to define a new filter. See Creating and configuring a filter for information.

Configure a filter action in 1 of the following ways:

Select a default filter action from the Action name drop-down list. If you want to change the default action settings, click Edit.

You can also create a new action for your rule by selecting Add Action from the drop-down list.

See Creating and configuring a filter action for information.

Editing rules

Click a rule name, and use the Add (or Edit) Policy > Edit Rule page to define what happens to an email message that matches the sender/recipient conditions and triggers the policy. This page contains the filter and filter action that currently define the rule that you clicked. You can also define message sender/recipient conditions that, when met, allow a message to bypass the filter.

Editing the filter

To edit the filter, click Edit in the Filter section to open the Edit Filter page. Modify filter characteristics as described in Creating and configuring a filter.

Editing the filter action

To edit the filter action, click Edit in the Action section to open the Edit Action page. Modify action options as described in Creating and configuring a filter action.


	Note Any change you make to existing rule components will be reflected in the filter and action definitions you configured in the Main > Policy Management > Filters and Main > Policy Management > Actions pages. The changes are not unique to the individual policy.

Adding filter bypass conditions

To add filter bypass conditions, click Add in the Filter Bypass Condition section to open the Add Filter Bypass Conditions page. You can create filter bypass entries in the Sender Email Addresses, Recipient Email Addresses, and IP Address Groups sections in 1 of the following ways:

Add a predefined email address list by clicking Browse next to the Email Address File field and navigating to the desired text file. The file format should be 1 email address per line, up to a maximum of 8 addresses.

Enter an individual email address in the Email address field. Click the right arrow button to add the individual entry to the Email Address List on the right.

Select the IP address groups you want to bypass analysis, and click the arrow button to add them to the Added IP Address Groups box. You can also define a new IP address group on this page if desired.

An asterisk (*) may be used in an address as a wildcard.

Click OK to save your bypass entries.

You can delete an entry in an Email Address List by selecting it and clicking Remove. Export and save an address list as a text file by clicking Export All.

You cannot use these settings to bypass a custom content filter.