Example Rules

11 articles

Digest generation and Quarantines

Email Security will process your Message Rules in priority/rule order. These rules are used, among other things, to determine a Spam Score for each message. The default set of rules contain a Confirm…

Updated 2 months ago by admin

Executive Tracking

This Rule detects "whaling" attacks. A whaling attack, sometimes called a "whale phishing" attack or CEO Fraud, is a specific type of phishing attack that targets high-profile employees such as the C…

Updated 1 year ago by admin

Blocking emails from hacked Gmail accounts

Some Gmail accounts - either legitimate accounts that have been hacked, or spam accounts created for malicious purposes - will send emails with little or no content. For example, an email with a subj…

Updated 6 months ago by admin

Stop specific users from receiving Word documents

This example Rule prevents certain users from receiving Word documents. It could easily be adapted to other types of file attachment. If you want to prevent specific users from receiving emails with…

Updated 4 years ago by admin

Detect credit card numbers in an email

This article explains how to detect an email containing something that looks like a credit card number. Visit your USS Dashboard and click Products ⟶ E-mail Security ⟶ Custom Rule Data. Click to crea…

Updated 8 months ago by admin

Disable spam filtering for specific mailboxes

You may wish to entirely disable spam filtering for certain mailboxes in your organisation. Email Security allows you to do so easily, by simply setting up a new Message Rule. Visit your USS Dashboar…

Updated 4 years ago by admin

Nearby Domain Rule

This Rule compared domains in the email header to your configured domains. It will trigger when domains in the header are very similar to (but not identical to) your configured domains. For example,…

Updated 2 years ago by admin

How to Prefix a banner to inbound emails

It may be a requirement within EMS that all external emails are stamped with a banner notifying recipients that the email was received from outside of the business. This is particularly useful to hel…

Updated 1 year ago by admin

IP Geolocation connection Rule

This Rule detects the location of the connecting IP address. It will classify the IP to a country of origin. You can then use the Rule to reject certain countries, or to only allow specific countries…

Updated 4 years ago by admin

CoreService filter classifications

The below table summarises the Core Service classifications and where they are used within Message Rules. Classification Used in Message Rule Description CoreService Bounce n/a Bounce messages (non-d…

Updated 11 months ago by admin

Reject oversized emails

EMS accepts emails up to 50Mb inbound or outbound. Should your mail server (Domain Route) not accept this size of message, you can reject the message at the point of SMTP connection. This will make t…

Updated 3 years ago by admin