Example Rules

13 articles

Digest generation and Quarantines

Email Security will process your Message Rules in priority/rule order. These rules are used, among other things, to determine a Spam Score for each message. The default set of rules contain a Confirm…

Updated 1 year ago

Executive Tracking

This Rule detects "whaling" attacks. A whaling attack, sometimes called a "whale phishing" attack or CEO Fraud, is a specific type of phishing attack that targets high-profile employees such as the C…

Updated 2 years ago

Blocking emails from hacked Gmail accounts

Some Gmail accounts - either legitimate accounts that have been hacked, or spam accounts created for malicious purposes - will send emails with little or no content. For example, an email with a subj…

Updated 2 years ago

Stop specific users from receiving Word documents

This example Rule prevents certain users from receiving Word documents. It could easily be adapted to other types of file attachment. If you want to prevent specific users from receiving emails with…

Updated 5 years ago

Detect credit card numbers in an email

This article explains how to detect an email containing something that looks like a credit card number. Visit your USS Dashboard and click Products ⟶ E-mail Security ⟶ Custom Rule Data. Click to crea…

Updated 2 years ago

Disable spam filtering for specific mailboxes

You may wish to entirely disable spam filtering for certain mailboxes in your organisation. Email Security allows you to do so easily, by simply setting up a new Message Rule. Visit your USS Dashboar…

Updated 5 years ago

Nearby Domain Rule

This Rule compares domains in the email header to your configured domains. It will trigger when domains in the header are very similar to (but not identical to) your configured domains. For example,…

Updated 1 year ago

Reject Disabled user accounts (mailboxes)

This article provides a technique to reject disabled user accounts (i.e. mailboxes or email addresses). Rejecting disabled accounts will ensure these mailboxes are excluded from billable Email Securi…

Updated 2 weeks ago by admin

How to Prefix a banner to inbound emails

It may be a requirement within EMS that all external emails are stamped with a banner notifying recipients that the email was received from outside of the business. This is particularly useful to hel…

Updated 2 years ago by admin

IP Geolocation Connection Rule

This Connection Rule detects the location of the connecting IP address. It will classify the IP to a country of origin. You can then use the rule to reject certain countries, or to only allow specifi…

Updated 11 months ago

CoreService filter classifications

The below table summarises the Core Service classifications and where they are used within Message Rules. Classification Used in Message Rule Description CoreService Bounce n/a Bounce messages (non-d…

Updated 2 years ago by admin

Empty Body Detection

The Empty Body detection feature has been designed to detect empty body (blank) emails. This includes emails such as: Empty bodies (including white space) with or without attachments to the email. Em…

Updated 1 month ago by admin

Reject oversized emails

Email Security accepts emails up to 50Mb inbound or outbound. Should your mail server (Domain Route) not accept this size of message, you can reject the message at the point of SMTP connection. This…

Updated 1 year ago