Prioritizing the filtering rules
Mail Security evaluates messages using all of the filtering rules that you enable. By default, Mail Security applies rules in the order in which you enable them. For example, if you enable the Sample Executable File rule and then enable the Quarantined Triggered Subjects rule, Mail Security priorities the Sample Executable File rule first. However, you can specify the order in which you want Mail Security to apply the rules.
If a message violates more than one rule, Mail Security applies the most severe disposition of the rules that were violated. This ensures that your environment maintains the highest level of protection.
The severity levels, from most severe to least severe, are as follows:
- Delete entire message
- Delete attachment/message body and replace with text
- Quarantine entire message and replace with text
- Quarantine attachment/message body and replace with text
- Add tag to beginning of subject line
- Log only
For example, assume that you have two filtering rules enabled: Rule A and Rule B. Rule A is the higher priority, and the rule action is “Log only.” Rule B is the lower priority, and the rule action is to “Delete entire message.” A message that violates both rules is deleted.
If the message violates more than one rule and all of the rules have the same disposition, Mail Security uses the prioritization categorization to determine which rule action to apply.
For example, assume that you have two filtering rules enabled: Rule C and Rule D. Rule C is the higher priority, the rule action is “Add tag to the beginning of subject line,” and your customized text is "Spam." Rule D is the lower priority, the rule action is “Add tag to the beginning of subject line,” and your customized text is "Prohibited content." A message that violates both rules will have the subject line prepended with "Spam."
The rule order does not change in the Content filtering rules table. You can only view and modify rule prioritization in the
Rule prioritization
window. - To prioritize the filtering rules
- In the console on the primary navigation bar, clickPolicies.
- In the sidebar underContent Enforcement, clickContent Filtering Rules/File Type Filtering Rules.
- In the sidebar underTasks, clickPrioritize rules.More than one rule must be enabled to prioritize rules.
- In theRule prioritizationwindow, click a rule to select it.
- ClickMove uporMove downuntil the rule is at the priority that you want.Rules are prioritized from top to bottom, with the top being the highest priority.
- ClickOK.
- On the toolbar, clickDeploy changesto apply your changes.