Prioritizing content filtering rules
|Article:HOWTO82473|||||Created: 2012-11-30|||||Updated: 2013-10-28|||||Article URL http://www.symantec.com/docs/HOWTO82473|
Mail Security evaluates messages using all of the content filtering rules that you enable. By default, Mail Security applies rules in the order in which you enable them. For example, if you enable the Sample Executable File rule and then enable the Quarantined Triggered Subjects rule, Mail Security priorities the Sample Executable File rule first. However, you can specify the order in which you want Mail Security to apply the rules.
If a message violates more than one rule, Mail Security applies the most severe disposition of the rules that were violated to ensure that your environment maintains the highest level of protection.
The severity levels, from most severe to least severe, are as follows:
Delete entire message
Delete attachment/message body and replace with text
Quarantine entire message and replace with text
Quarantine attachment/message body and replace with text
Add tag to beginning of subject line
For example, assume that you have two content filtering rules enabled: Rule A and Rule B. Rule A is the higher priority, and the rule action is "Log only." Rule B is the lower priority, and the rule action is to "Delete entire message." A message that violates both rules is deleted.
If the message violates more than one rule and all of the rules have the same disposition, Mail Security uses the prioritization categorization to determine which rule action to apply.
For example, assume that you have two content filtering rules enabled: Rule C and Rule D. Rule C is the higher priority, the rule action is "Add tag to the beginning of subject line," and your customized text is "Spam." Rule D is the lower priority, the rule action is "Add tag to the beginning of subject line," and your customized text is "Prohibited content." A message that violates both rules will have the subject line prepended with "Spam."
The rule order does not change in the Content filtering rules table. You can only view and modify rule prioritization in the Rule prioritization window.
To prioritize content filtering rules
In the console on the primary navigation bar, click Policies.
In the sidebar under Content Enforcement, click Content Filtering Rules.
In the sidebar under Tasks, click Prioritize rules.
More than one rule must be enabled to prioritize rules.
In the Rule prioritization window, click a rule to select it.
Click Move up or Move down until the rule is at the priority that you want.
Rules are prioritized from top to bottom, with the top being the highest priority.
On the toolbar, click Deploy changes to apply your changes.
Article URL http://www.symantec.com/docs/HOWTO82473