|
Policy Patrol includes several sample rules to help you enforce your
email policy as soon as possible. You can use the sample rules as they
are, adjust them, or make your own rules. The program also includes some
sample filters and templates that are not used in the sample rules. All
sample rules are described below with information on how to configure
them.
1. Delete messages from the Spam senders filter
This rule applies to all externally received messages and deletes
messages that are sent from domains in the Spam senders filter,
except if the domain or email address is listed in the Newsletter,
Exclude from Spam senders or Automatic white list filter.
Policy Patrol adds the sender domain to the Spam senders filter each
time a message triggers the rule 'Add tag to spam messages'. Since the
recipient first sees the message with the spam tag, the user can warn
the Administrator if the message was wrongly identified as spam. The
Administrator must then either add the domain to the Newsletter
or Exclude from Spam senders filter. The Exclude from Spam
senders filter includes domains such as hotmail.com and yahoo.com. This
is because some spammers pretend to send their messages from these
domains, and you would probably not want to delete all messages from
these domains. Finally, the automatic white list includes a list of all
domains that users have sent emails to, and therefore cannot be spam
senders.
Required: Enable the rule. For the rule to work, you must also enable
the rules 'Add tag to spam messages' and 'Automatically create white
list'.
 Optional:
Instead of deleting you could add a tag, or quarantine the mails. You
can add more domains to exclude in the Exclude from Spam senders and
Newsletter filter. Tip: If you want to give your users two chances to
add an address to the Newsletter or Exclude from Spam senders filters
(i.e. to avoid these messages from being deleted), you can first add
spammers to a Spam senders 1 filter. If they send another spam message,
add the sender to Spam senders 2 filter. Then change this rule to delete
all mails from Spam senders 2 filter. If you are not sure how to create
these rules, you can use the rules 'Delete all mails from re-offending
virus senders' and 'Add re-offending virus senders to filter' as an
example.
Back to top
2. Delete all mails from re-offending virus senders
This rule checks all externally received mails. If a mail is sent by
a sender in the Re-offending virus senders list, the mail is deleted and
the sender is notified that the message has been deleted. The
Re-offending virus senders list contains email addresses of senders of
at least two viruses.
Required: Enable the rule. For the rule to work, you must also enable
the rules 'Notify when virus is cleaned or deleted' and 'Quarantine
viruses that cannot be deleted'. Enter the company telephone number in
the Re-offending message deleted template.
Optional:
Instead of deleting you could add a tag, or quarantine the mails. You
can customize the template Re-offending message deleted.
Back to top
3. Delay large messages
This rule applies to all external messages and delays the delivery of
mails larger than 10 MB until after 6 pm. The size includes the message
body and all attachments. When the mail is delayed, the sender receives
the notification Your message has been delayed.
Required: Enable the rule.
Optional:
You can exclude certain users from this rule and increase or decrease
the message size condition. Furthermore, you can change the time of
delivery and the notification template Your message has been delayed.
Back to top
4. Add re-offending virus senders to filter
This rule applies to all messages and triggers if the sender is from
the Virus senders list and the message includes a virus. If both
conditions are met, the sender's email address will be added to the
Re-offending virus senders list.
Required: Enable the rule.
Back to top
5. Quarantine viruses that cannot be deleted
In Policy Patrol > Anti virus you can configure the options
for virus checking. Policy Patrol can detect and attempt to clean all
viruses that pass through it. If a virus cannot be cleaned, Policy
Patrol can try to delete it. However, Policy Patrol is not able to
delete the virus if this means deleting the whole message, which is the
case for internal messages, and possibly for an external message with an
infected attachment and no message body. To make sure that the messages
with viruses that could not be deleted do not get through, this sample
rule is included. The rule checks all messages for viruses that could
not be deleted and quarantines them. The Administrator will receive an
email notification and network message that an email with a virus has
been quarantined and the sender email address will be added to the Virus
senders filter. If the mail is rejected, the sender will receive
notification of this.
Required: Open the rule properties and click on the send network
message link. In the To field enter the IP address of the
Administrator’s machine for sending the network message. Enable the
rule.
Optional:
You can customize the templates Undeleted virus quarantined and Message
with virus deleted.
Back to top
6. Quarantine suspected viruses
This rule applies to all messages and quarantines messages with
suspected viruses or password protected attachments that could not be
scanned. When a message is quarantined the Administrator receives a
notification message. If the message is rejected, the sender receives a
notification email.
Required: Enable the rule.
Optional:
You can edit the notification messages Suspected virus quarantined and
Message with suspected virus deleted.
Back to top
7. Quarantine all scripts
This rule checks all messages and quarantines mails that contain HTML
scripts in the message body and/or HTML attachment(s). The Administrator
will receive notification when messages are quarantined so that they can
be checked for malicious content. The Administrator can then decide to
accept or reject the message. The Administrator can also decide to
remove the HTML version of the mail and deliver it in plain text instead,
or to remove a particular attachment.
Required: Enter the company telephone number in the Script sent deleted
template. Enable the rule.
Optional:
You add more script tags to the Script tags filter and customize the
notification templates Script sent quarantined and Script sent deleted
and instead of quarantining scripts, convert all mails that contain
scripts to plain text. You can also exclude certain users from the rule.
Back to top
8. Quarantine offensive content
This rule applies to all mails and quarantines messages that include
offensive content in the message subject, body or attachment. A
notification is sent to the recipient's and sender's manager to view and
accept or reject the mail. If the mail is rejected the sender receives a
notification.
Required: Enter the company telephone number and company email address
in the Inappropriate mail deleted template. If you wish to check Word
documents you must enable Microsoft Word checking in server name >
Properties > Attachment checking and install Microsoft Office
XP on the server machine. Enable the rule.
 Optional:
You can customize the Offensive content word/phrase filter and apply the
rule to certain users. Furthermore, you can customize the notification
templates Inappropriate mail sent, Inappropriate mail received and
Inappropriate mail deleted. For internal mails, two managers will
receive a notification. If you do not wish this to happen, you can make
one rule for external messages and configure a notification to be sent
to the sender's and recipient's manager. Then create another rule that
checks internal messages and only sends a notification to either the
sender's or recipient's manager. Tip: You can attach your email policy
to the reject email.
Back to top
9. Block dangerous attachment types
This rule applies to all messages and quarantines attachment types
that might contain viruses or harmful scripts. A notification is sent to
the Administrator to view and accept or reject the mail. If the message
is rejected, the sender will receive a notification message.
Required: Enter the company telephone number in the Dangerous attachment
type deleted template. Enable the rule.
Optional:
You can customize the Dangerous attachment types filter and exclude
certain users from the rule. Furthermore you can customize the templates
Dangerous attachment type quarantined and Dangerous attachment type
deleted.
Back to top
10. Block spoofed attachments
This rule checks all attachments for spoofing. It checks for multiple
extensions, CLSID extensions, binary files that have been disguised as
text files, and it will attempt to verify the attachment extension. If
the attachment is spoofed, the message will be quarantined and a
notification is sent to the Administrator to review the message, and to
the sender to inform them that the message is under review. If the
message is deleted, the sender will receive a notification message.
Required: Enable the rule.
Optional:You
can customize the templates Spoofed attachment quarantined, Spoofed
attachment sent and Spoofed attachment deleted.
Back to top
11. Notify when virus is cleaned or deleted
This sample rule applies to all messages and notifies the
Administrator, sender and recipient that a virus was found and
successfully removed. Finally, the sender is added to the Virus senders
Email addresses/domains filter.
Required: Enable the rule.
Optional:
You can customize the notification templates Virus cleaned/ deleted,
Removed virus sent, and Removed virus received.
Back to top
12. Add signature
This rule applies to all sent messages and adds a signature after the
last entered message text.
Required: Enter your URL in the Signature template. Enable the rule.
Optional:
You can customize the signature by going to Templates > Disclaimer
and double-clicking on the Signature template. Tip: Do not enter too
much text in the Signature Word/Phrase filter since this will require
more processing time.
Back to top
13. Add external disclaimer
This rule adds a disclaimer to every externally sent message, except
if [No disclaimer] is found in the subject. In this way, users will be
able to disable a disclaimer for a particular email by entering [No
disclaimer] in the subject. The [No disclaimer] entry is then removed
from the subject by the rule Remove [No disclaimer] from the subject.
The rule prevents adding multiple disclaimers when replying or
forwarding by searching the body for part of the disclaimer text. If it
finds the text, it will not add the disclaimer again.
Required: Enable the rule. Enable the rule Remove [No disclaimer] from
the subject.
Optional:
You can customize the disclaimer text by going to Templates >
Disclaimer and double-clicking on the External disclaimer template. It
is a good idea to include your company name in the External disclaimer
filter along with a few words from your disclaimer to make sure the
exclusion applies to your company's disclaimer as opposed to the
sender's or recipient's disclaimer. Remember that if you change the
disclaimer text you must also change the External disclaimer Word/Phrase
filter. Tip: Do not enter too much text in the External disclaimer
Word/Phrase filter since this will require more processing time.
Back to top
14. Add internal disclaimer
This rule adds a disclaimer to every internally sent message. It
prevents adding multiple disclaimers when replying or forwarding by
searching the body for part of the disclaimer text. If it finds the text,
it will not add the disclaimer again.
Required: Enable the rule.
Optional:
You can customize the disclaimer by going to Templates > Disclaimer
and double-clicking on the Internal disclaimer template. Remember that
if you change the disclaimer text you must also change the Internal
disclaimer Word/Phrase filter. Tip: Do not enter too much text in the
Internal disclaimer Word/Phrase filter since this will require more
processing time.
Back to top
15. Automatically create white list
This rule applies to externally sent messages and adds the To: domain
to the Automatic white list filter every time a user sends out an
email. This filter is then used as an exception in the 'Add tag to Spam
messages' and 'Delete messages from Spam senders filter' rules.
Required: Enable the rule.
Back to top
16. Add tag to spam messages
This rule applies to externally received messages and adds the tag 'SPAM:'
to messages that:
- Include spam header characteristics.
- Are detected as spam by the real time Spam blocker.
- Include spam words or offensive content in body and/or subject.
- Have more than 15 recipients.
- Use Korean or Chinese character sets.
In addition to adding the tag, the rule adds the senders' email
addresses to the Spam senders Email addresses/domains filter. If
another message is received from the same sender, the message will be
deleted by the rule 'Delete messages from the Spam senders filter'.
Advise your users that if a message is tagged wrongly as spam (this
happens with newsletters for instance), they should ask the
Administrator to add the from: email address to the Newsletter or
Exclude from spam senders filter so that it no longer gets tagged
as spam and it does not get deleted. In this way, the possibility of
wrongly deleting emails is minimized. Furthermore, the 'SPAM:' tag will
not be added if the sending domain is listed in the Automatic white
list filter, which includes a list of all domains that users have
sent emails to.
Required: Enable the rule and add the from email addresses of allowed
newsletters to the Newsletter filter. Configure the spam blocker:
Tick Enable real time spam blocker. Click Add and enter
the Zone and Returns. For instance for the Spamhaus Block List (SBL),
enter sbl.spamhaus.org for the zone and 127.0.0.2 for the Returns.
Select Add the following X-header to the message and enter
SPAMHAUS as the X-header. Click OK. Finally, enable the rule 'Automatically
create white list'.
Optional:
You can customize the Spam words and Offensive content filter, add or
remove spam characteristics, and increase or decrease the number of
recipients condition. Furthermore you can increase the word score
threshold or choose to delete the messages, rather than adding a tag and
then deleting the message if sent from the Spam senders list.
 Policy
Patrol can block HTML messages without a plain text body part.
HTML messages usually include a plain text version of the email so that
recipients with email clients that cannot read HTML can still view the
message in plain text. However, many spammers tend to send HTML messages
without this plain text body part, not only to save on size but also to
force recipients to read the HTML version. This enables spammers to
embed an image link in the HTML code that connects to a site when the
message is opened. In this way, spammers know how many people have
viewed their message. Furthermore by using a unique ID, spammers know
exactly which recipients viewed the message and which email addresses
are still 'live'. As soon as spammers know that an email address is
live, they will send even more spam messages. Therefore it is important
to configure
a rule in Policy Patrol to block these messages.
Back to top
17. Customize Delivery Status Notifications
This rule applies to all internally sent Delivery Status
Notifications (DSN) (from postmaster) and customizes DSN 4.4.7, 5.1.1,
5.5.0 and 5.7.1.
Required: Select the postmaster account as the user and enable the rule.
Optional:
You can customize the templates DSN 4.4.7, 5.1.1, 5.5.0 and 5.7.1. You
can also customize externally sent DSNs by applying the rule to
externally sent messages as well as internally sent messages.
Back to top
18. Remove [No disclaimer] from the subject
This rules applies to all messages and removes '[No disclaimer]' from
the subject. Users can enter this in the subject if they want to disable
a disclaimer for a particular mail. This rule will then remove [No
disclaimer] from the subject so that the recipient will not see it.
Required: Enable the rule.
Optional:
You can change the [No disclaimer] code and filter if you wish.
Back to top
19. Compress attachments larger than 1 MB
This rule applies to all external messages and compresses attachment(s)
if a message is found with an attachment larger than 1 MB, unless it is
already compressed.
Required: Enable the rule.
Optional:
You can change the comment for the newly created zip file, and you can
select to compress each attachment in a separate file. Furthermore, you
can change the attachment size that triggers the rule and exclude more
file types.
Back to top
20. Archive all mails
This rule archives all messages into the monthly Default Archive.
Required: Enable the rule.
Optional:
In the Default Archive properties, you can change the path where the XML
file is saved. By default this is C:\. You can also create a new archive
that is saved in csv or xml format and is created daily, monthly or
quarterly. You can select the fields to be included in the archive.
Finally, you can apply the archive rule only to certain users or
customers and add a billing code.
Back to top
|
