Prioritizing the filtering rules

Mail Security evaluates messages using all of the filtering rules that you enable. By default, Mail Security applies rules in the order in which you enable them. For example, if you enable the Sample Executable File rule and then enable the Quarantined Triggered Subjects rule, Mail Security priorities the Sample Executable File rule first. However, you can specify the order in which you want Mail Security to apply the rules.
If a message violates more than one rule, Mail Security applies the most severe disposition of the rules that were violated. This ensures that your environment maintains the highest level of protection.
The severity levels, from most severe to least severe, are as follows:
  • Delete entire message
  • Delete attachment/message body and replace with text
  • Quarantine entire message and replace with text
  • Quarantine attachment/message body and replace with text
  • Add tag to beginning of subject line
  • Log only
For example, assume that you have two filtering rules enabled: Rule A and Rule B. Rule A is the higher priority, and the rule action is “Log only.” Rule B is the lower priority, and the rule action is to “Delete entire message.” A message that violates both rules is deleted.
If the message violates more than one rule and all of the rules have the same disposition, Mail Security uses the prioritization categorization to determine which rule action to apply.
For example, assume that you have two filtering rules enabled: Rule C and Rule D. Rule C is the higher priority, the rule action is “Add tag to the beginning of subject line,” and your customized text is "Spam." Rule D is the lower priority, the rule action is “Add tag to the beginning of subject line,” and your customized text is "Prohibited content." A message that violates both rules will have the subject line prepended with "Spam."
The rule order does not change in the Content filtering rules table. You can only view and modify rule prioritization in the
Rule prioritization
window.
  1. To prioritize the filtering rules
  2. In the console on the primary navigation bar, click
    Policies
    .
  3. In the sidebar under
    Content Enforcement
    , click
    Content Filtering Rules
    /
    File Type Filtering Rules
    .
  4. In the sidebar under
    Tasks
    , click
    Prioritize rules
    .
    More than one rule must be enabled to prioritize rules.
  5. In the
    Rule prioritization
    window, click a rule to select it.
  6. Click
    Move up
    or
    Move down
    until the rule is at the priority that you want.
    Rules are prioritized from top to bottom, with the top being the highest priority.
  7. Click
    OK
    .
  8. On the toolbar, click
    Deploy changes
    to apply your changes.