About match lists

Article:HOWTO82449  |  Created: 2012-11-30  |  Updated: 2014-06-25  |  Article URL http://www.symantec.com/docs/HOWTO82449
Article Type
How To


Subject


About match lists

Mail Security uses match lists to filter email messages and attachments for specific words, terms, and phrases. To implement a match list, you must associate it with a content filtering rule or file filtering rule. When the rule is applied to scan messages, it also scans for the terms in the match list.

See About regular expressions

See About DOS wildcard style expressions

Note:

The preconfigured match lists are designed to be used with content filtering rules. However, you can modify and use the preconfigured match lists with the File Name Rule file filtering rule.

Table: Preconfigured match lists lists the preconfigured match lists that Mail Security provides.

Table: Preconfigured match lists

Match list name

Description

Outbreak Triggered Attachment Names

When you enable outbreak management, Mail Security adds the names of outbreak-triggered attachments to the Outbreak Triggered Attachment Names match list.

You can use this match list with the Quarantine Triggered Attachment Names content filtering rule. This rule lets you automatically quarantine files with the attachment names that are found in the Outbreak Triggered Attachment Names match list.

You can edit the rule description and the text in the Filter box. Leave the match type as wild cards.

Note:

The preconfigured match lists are designed to be used with content filtering rules. However, you can modify and use the preconfigured match lists with the File Name Rule file filtering rule.

See Configuring outbreak triggers.

Outbreak Triggered Subject Lines

When you enable outbreak management, Mail Security adds the names of outbreak-triggered subject lines to the Outbreak Triggered Subject Lines match list.

You can use this match list with the Quarantine Triggered Subjects content filtering rule. This rule lets you automatically quarantine files with the subject line text that is found in the Outbreak Triggered Subject Lines match list.

You can edit the rule description and the text in the Filter box. Leave the match type as literal.

Note:

The preconfigured match lists are designed to use with content filtering rules. However, you can modify and use the preconfigured match lists with the File Name Rule file filtering rule.

See Configuring outbreak triggers.

Sample Attachment Name

This match list contains a list of attachment file names or extensions that might contain malicious code.

You can edit the rule description and add or remove file extensions in the Filter box. Leave the match type as wild cards.

Sample Executable File Names

This list contains the file names or extensions that can potentially execute malicious code.

Leave the match type as wild cards.

Sample Message Body Words

This list contains keywords and phrases typically found in the bodies of spam email messages.

You can edit the rule description, add, or remove keywords and phrases in the Filter box, and modify the match type. The default match type is literal.

Sample Multimedia File Names

This list contains file names or extensions of multimedia files.

Leave the match type as wild cards.

Sample Subject Line

This list contains keywords and phrases typically found in spam email message subject lines.

You can edit the rule description, add, or remove keywords and phrases in the Filter box, and modify the match type. The default match type is literal.

Canadian Social Insurance Keywords

This match list contains the keywords that indicate a Canadian social insurance number.

The default match type is literal. You can add or remove keywords in the Filter box.

Canadian Social Insurance Numbers

This match list contains a pattern that indicates a Canadian social insurance number. The default match type is regular expression.

Credit Card Number Keywords

This match list contains the keywords that are associated with a credit card number.

The default match type is literal. You can add or remove keywords in the Filter box.

Credit Card Number Pattern

This match list contains a pattern that indicates a credit card number. The default match type is regular expression.

M and A Project Code Names

This match list contains the keywords that can help you identify information or communication about upcoming merger and acquisition activity. For example, MergerProjectName.

The default match type is literal. You can add or remove keywords in the Filter box.

Sensitive Project Code Names

This match list contains sensitive project code names.

The default match type is literal. You can add or remove keywords in the Filter box.

SWIFT Code Keywords

This match list contains the keywords that are associated with Society for Worldwide Interbank Financial Telecommunication (SWIFT) codes.

The default match type is literal. You can add or remove keywords in the Filter box.

SWIFT Code Regex

This match list contains a pattern that indicates a SWIFT Code. The default match type is regular expression.

UK Drivers Licence Numbers Pattern1

This match list contains a pattern that indicates a UK drivers licence number. The default match type is regular expression.

UK Drivers Licence Numbers Pattern2

This match list contains another pattern that indicates a UK drivers licence number. The default match type is regular expression.

UK Electoral Roll Numbers Keywords

This match list contains the keywords that indicate a UK electoral roll number.

The default match type is literal. You can add or remove keywords in the Filter box.

UK Electoral Roll Numbers Pattern

This match list contains a pattern that indicates a UK electoral roll number. The default match type is regular expression.

UK Keywords

This match list contains the keywords that indicate UK-related information.

The default match type is literal. You can add or remove keywords in the Filter box.

UK NIN Keywords

This match list contains the keywords that indicate a UK national insurance number.

The default match type is wild cards. You can add or remove keywords in the Filter box.

UK NIN Pattern

This match list contains a pattern that indicates a UK national insurance number. The default match type is regular expression.

UK Passport Keywords

This match list contains the keywords that indicate a UK passport number.

The default match type is wild cards. You can add or remove keywords in the Filter box.

UK Passport Pattern (New)

This match list contains a pattern that indicates a UK passport number. The default match type is regular expression.

UK Passport Pattern (Old)

This match list contains another pattern that indicates a UK passport number. The default match type is regular expression.

UK Tax ID Number Keywords

This match list contains the keywords that indicate a UK tax ID number.

The default match type is literal. You can add or remove keywords in the Filter box.

UK Tax ID Number Pattern

This match list contains another pattern that indicates a UK tax ID number. The default match type is regular expression.

US ITIN Keywords

This match list contains the keywords that indicate a US individual taxpayer identification number (ITIN).

The default match type is literal. You can add or remove keywords in the Filter box.

US ITIN Pattern

This match list contains a pattern that indicates a US individual taxpayer identification number. The default match type is regular expression.

IP Address Pattern

This match list contains a pattern that indicates an IP address. The default match type is regular expression.

US SSN Keywords

This match list contains the keywords that indicate a US individual social security number (SSN).

The default match type is literal. You can add or remove keywords in the Filter box.

US SSN Patterns

This match list contains another pattern that indicates a US individual social security number. The default match type is regular expression.

See Creating or editing a match list

See Deleting a match list


Legacy ID



SMSID0EOEBI_v82634657


Article URL http://www.symantec.com/docs/HOWTO82449


Terms of use for this information are found in Legal Notices