Content Examination Definitions: Using Reference Dictionaries

Document created by user.oxriBaJeN4 Employee on Sep 21, 2015Last modified by user.oxriBaJeN4 Employee on Apr 2, 2019
Version 12Show Document
  • View in full screen mode

Content Examination definitions can link to a reference dictionary. These are typically created by you to contain a list of words, phrases, or regular expressions. Multiple definitions can point to the same dictionary.


An example would be for a customer implementing HIPAA compliance. The compliance policy may state that all messages that contain both a medical term and a Social Security Number (SSN) should be held and not delivered outbound. You would create a reference dictionary containing all the medical terms, as well as one with the regular expression for SSNs. When creating the Content Examination definition, both of these reference dictionaries can then be linked to by using the Insert menu.


Creating a Reference Dictionary


To create a reference dictionary:

  1. Open the Administration Console.
  2. Click on the Gateway | Policies menu item.
  3. Click on the Definitions drop down on the top toolbar.
  4. Select the Content Definitions menu item.
  5. Select a Folder in the navigator into which the definition is to be created. You cannot create a definition in the "Root" folder.
  6. Click on the New Content Definition button.
  7. Enter a Description. This name is logged against the email when a match is found.
  8. Select the Definition Type of "Reference Dictionary".
  9. Enter the search parameters in the Word / Phrase Match List. The formats for the search parameters are:

    Search ParametersExample
    Weight [ :maxscore ] [ search text ]4:1 “Company Confidential”
    Weight [ :maxscore ] [ required ] [ search text ]1 required “Project X”
    Weight [ :maxscore ] [ exclude ] [ search text ]>1 exclude “Tax exemption”
    Weight [ :maxscore ] [ regex ] [ regular expression ]10 regex 4[0-9]{12}(?:[0-9]{3})?
    Weight [ :maxscore ] [ hash ] [ MD5# ]1 hash 9EBD30E761ED4FF770A90DDBD5CB4190 Confidential.PDF
  10. Click on the Save and Exit button.


Parameter Details


When specifying search parameters, the following rules must be followed:

WeightEach line must begin with the required score for that particular word or phrase.
Maximum ScoreThere is the option to set the number of occurrences in the email that should trigger the definition. If an entry of 1:10 is added before the search term, We will match up to ten instances of the search term.  If 1: is entered before the search term, there is no upper limit to the score. This scoring is only used if the option Match Multiple Words is enabled in the actual Content Examination definition.
ConditionsThe optional operators “required” and “exclude” can also be used. Add the word required, if the match term is specifically required for the policy to trigger. If a required item is not found, the weight is set to zero and no further scoring takes place. If the word exclude is added after the weight, and the match term does exist, the weight is set to zero and no further scoring takes place. Required and exclude terms should be placed in the first line of the search term list.
Search Text / PhrasesEnter single words or phrases, enclosing multiple words in quotation marks (e.g. “one two”).
Regular ExpressionsThe expression must be preceded with the word “regex”. Regular expressions can be used to detect structured strings like Social Security Numbers or Credit Card Numbers in emails.
MD5#Enter the “hash” at the beginning of the line (or following the score if relevant) followed by the MD5 code of the attachment. The MD5# is a unique reference given to specific file contents. If the attachment is known to us (i.e. we have previously processed the attachment) this checksum is located in the Transmission Data when viewing the email delivery details.
CommentsAdd by using a hash symbol (#) at the beginning of the line. These are ignored when examining the email for matches.


Adding a Reference Dictionary to a Definition


To add a reference dictionary to a definition:

  1. Log on to the Administration Console.
  2. Click on the Administration menu item. A menu drop down is displayed.
  3. Click on the Gateway | Policies menu item.
  4. Hover over the Definitions button. A list of the definition types is displayed.
  5. Click on the Content Examinations definition type from the list. The list of definitions is displayed.
  6. Either click on the:
    • Definition to be changed.
    • New Content Definition button.
  7. Click on the Insert button. 
  8. Click on the Reference Dictionary menu item.
  9. Complete the Policy Definition dialog as follows:
    Field / OptionDescription
    AppendIf selected, the reference dictionary is placed at the bottom of the "Word / Phrase Match List". If unselected, it is placed at the top of the list.
    Link Content ReferenceSelect the required reference dictionary:
    1. Click on the Lookup button.
    2. Navigate to the Folder in the hierarchy containing the reference dictionary.
    3. Click on the Select link to the left of the reference dictionary.
    CommentAdd any notes that refer to the reference dictionary. These are only displayed in the "Word / Phrase Match List" field prefixed by a hash symbol (#). All comments are ignored when examining messages for matches.
  10. Click on the Save and Exit button.


See Also...