Content Filters, Message Policies, and Data Loss Prevention
This domain covers the policy engine that inspects message content and takes action: content filters, CLI message filters, mail policy binding, and DLP classifiers with their responses such as encryption, quarantine, or drop.
Core rules
- Content filters are built in the GUI and attached to mail policies; they combine conditions (sender, recipient, subject, body, attachment type, dictionary or regex match, connection details) with actions (drop, quarantine, add header, notify, send to alternate host, encrypt).
- Message filters are written in the CLI and are ordered explicitly; they can do things content filters cannot, such as acting on envelope or connection attributes, and they can stop evaluation of later filters.
- DLP policies use built-in templates (payment card data, health information) or custom classifiers combining regex and dictionaries with weights and thresholds. A DLP policy must be attached to a mail policy before it can act, and its response is usually quarantine, encryption, or drop plus incident reporting to a management appliance.
- Filter order determines the outcome when two filters could match; the first matching action that terminates processing wins.
Worked example
Outbound messages containing payment card numbers must be encrypted. Create a custom DLP classifier with a card-number regex requiring a valid checksum pattern, set a threshold so a single ambiguous match does not trigger, attach the DLP policy to the outbound mail policy, and add a content filter whose condition is the DLP violation and whose action applies the encryption profile and adds a compliance header. Order this filter after virus scanning so infected mail is never encrypted and delivered. Test with a synthetic card number and confirm the recipient receives an encrypted envelope.
Traps
- Writing a regex that matches too broadly; validate against false-positive samples such as order numbers.
- Assuming DLP fires without being attached to a mail policy and licensed.
- Filter ordering surprises: an earlier drop or quarantine prevents a later encryption filter from running.
- Using
drop()when quarantine would preserve the ability to release a false positive. - Referencing a quarantine or encryption profile by a name that does not exist.