Adding/Editing a Keyword or Expression during Policy Creation/Modification

Procedure

1. Create or modify an "Other" (not an Antivirus) policy.
   • For information on creating a new rule, see Configuring Policies.
   • For information on modifying an existing rule, see Configuring Existing Policies.
2. Under Content on the Scanning Conditions screen, click the link that specifies the part of the message to which you want to configure content conditions.
   The Keyword Expressions screen appears with two columns.
3. Click Add or Edit from the Keyword Expressions screen.
   The configuration screen for keyword expression lists appears.
4. Next to List name, specify a descriptive name.
5. Next to Match, select one of the following that specifies when IMSS takes action:
   • Any specified: Message content can match any of the expressions in the list.
   • All specified: Message content must match all the expressions in the list.
   • Not the specified: Message content must not match any of the expressions in the list.
   • Only when combined score exceeds threshold: Next to Total message score to trigger action, specify a number that represents the maximum score for allowed keyword expressions. When you add an expression, you can set a value for the Score.
6. To create an expression, click Add.
   The Add Keyword Expression list appears.
7. Specify the keywords. For a partial match, specify the keyword. To specify an exact match, use \b before and after the keyword.
   For example:

   • keyword matches "keywords", "akeyword"
   • \bkeyword\b matches "keyword" only
8. Specify a description for the keywords.
9. If you selected Only when combined score exceeds threshold:
   1. Specify a threshold in the Total message score to trigger action field.
   2. Select a value from the Score drop-down box.
10. Click Save.
11. For IMSS to consider the capitalization of message content when it uses the filter, select the check box under Case sensitive.
12. Click Save to continue modifying or creating the policy.