Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Content Filtering with multiple conditions (lack of OR)

Created: 16 Jan 2013 | 1 comment

We need to update a filtering policy to have multiple conditions.  We are currently blocking all executable files with a content filter rule that says:

Condition: If the attachment or body part is in the attachment list "Executable Files"

Action: Delete Message

We have some senders who should be able to send us executable files.  We have created a dictionary which is a mixture of email address and domains.  We want to use specific email addresses when possible to limit the number of addresses that can send us EXEs.  The condition section that lets you filter by dictionary makes you choose between email addresses and domains so I haven't been able to build a complete filter that has both sub conditions

What I need to create is a condition that looks like:

If the attachment or body part is in the attachment list "Executable Files"

AND (

If text in Envelope sender part of the message header does not contain Domain name from dictionary "Active Content bypass"

OR

If text in Envelope sender part of the message header does not contain email address from dictionary "Active Content bypass"

)

Any thought on how I can achieve this?

Discussion Filed Under:

Comments 1 CommentJump to latest comment

cemilebaşak's picture

Hi;

Instead of put this on a policy. Create a different policy group and put this senders on that policy group. And then apply your policy to that group.

Regards;

Cemile Denerel BAŞAK

Note: Please mark as solution if its help you.