Content Examination Definitions: Insert Menu

Document created by user.oxriBaJeN4 Employee on Sep 21, 2015Last modified by user.oxriBaJeN4 Employee on Oct 4, 2015
Version 2Show Document
  • View in full screen mode

The Insert menu is a menu option available as part of Content Examination Definition creation.  Administrators can build definitions by using the Insert Menu to add or reference different content examination strings. The Insert menu has many uses when creating Content Definitions.  It can assist with creating basic search terms, generating the hash algorithm for a document, or linking a content definition to a pre-configured Reference Dictionary or regular expression.

 

Complicated Content Examination definitions may reference multiple Reference Dictionaries or a combination of Reference Dictionaries and Regular Expressions.  By using the Insert menu, a single Content Definition can search across multiple dictionaries, regular expressions or document hashes.

 

How do I use the Insert Menu?

The Insert menu is a default menu option available when configuring a Content Definition.

  1. Navigate to Gateway | Policies.
  2. Click on the Definitions button associated with the Content Examination Policy.
  3. Click on the New Content Definition button.
  4. Enter a meaningful Description. This name is logged against the email when a match is found, so it is recommended to use something expressive
  5. Select the Definition Type, which can either be an Independent Content Definition or a Reference Dictionary.  An Independent Content Definition simply adds the search text as part of the definition, whereas a Reference Dictionary allows you to create a dictionary that can be referenced by multiple Content Definitions
  6. The Activation Score is a required field, and enables Administrators to set a total score that must be met before the Content Definition will trigger.  This score must be set to a minimum of 1 up to a maximum of 100
  7. Select the Insert drop-down menu, which provides the following options:

Menu Option

Description

Search Term

  • Line Score: The value that this search term is assigned, which is compared to the Activation Score within the Content Definition
  • Append: Places this term at the bottom of the Word/Phrase match list in the Content Definition.  If not selected, the term is placed at the top of the list
  • Search Term: Allow Administrators to add specific words/phrases to search as part of the Content definition.
  • Comment: Notes that refer to the Search Term entered, viewed only within the Content Definition Word/Phrase Match List field.   These  are preceded by a hash symbol (#) at the beginning of the line, and will be ignored when examining the email for matches.

Regular Expression

  • Line Score: The value that this Regular Expression is assigned, which is compared to the Activation Score within the Content Definition
  • Append: Places this Regular Expression at the bottom of the Word/Phrase match list in the Content Definition.  If not selected, the term is placed at the top of the list
  • Regular Expression: Administrators can configure the Regular Expression to use as part of the Content Examination, as well as configuring the score for the specific line item and adding a comment.  Our support team is able to supply more information on building Regular Expressions if required
  • Comment: Notes that refer to the Regular Expression entered, viewed only within the Content Definition Word/Phrase Match List field.   These  are preceded by a hash symbol (#) at the beginning of the line, and will be ignored when examining the email for matches.

File MD5 Hash

  • Line Score: The value that this file is assigned, which is compared to the Activation Score within the Content Definition
  • Append: Places this MD5 Hash at the bottom of the Word/Phrase match list in the Content Definition.  If not selected, the term is placed at the top of the list
  • Attachment MD5 Hash: Allows a file to be uploaded in order to generate the MD5# to include within the Content definition.
    Note: MD5 Hash is typically used to prevent any confidential documents from leaving the customers environment. By uploading the document, a MD5 hash is generated.  If Mimecast detects this in an email, the appropriate action (based on the Content Definition configuration) will be taken.
  • New File Upload: Use the Browse button to select the required file
  • Comment: Notes that refer to the MD5# entered, viewed only within the Content Definition Word/Phrase Match List field.   These  are preceded by a hash symbol (#) at the beginning of the line, and will be ignored when examining the email for matches.

Reference Dictionary

  • Append: Places this Reference Dictionary at the bottom of the Word/Phrase match list in the Content Definition.  If not selected, the Reference Dictionary is placed at the top of the list
  • Link Content Reference: A predefined Reference Dictionary can be used in multiple Content Definitions if required.  By clicking on the Lookup button, you are able to select from a list of available Reference Dictionary
  • Comment: Notes that refer to the Reference Dictionary selected, viewed only within the Content Definition Word/Phrase Match List field.   These  are preceded by a hash symbol (#) at the beginning of the line, and will be ignored when examining the email for matches.

Mimecast Managed Reference Dictionary

Mimecast provides a set of pre-defined Managed Reference Dictionaries (MMRDs).  The configuration options are the same as described in the section above on Reference Dictionaries, and when the Lookup button is selected, the list of available MMRDs is displayed.
MMRDs are only available to customers utilizing our latest email Gateway.

Once the specific search criteria have been inserted into the Word/Phrase Match List, continue to complete the Content Definition and Content Examination Policy.

Attachments

    Outcomes