Situation	You want to create email filters to manage the flow of messages and information you allow to enter your company.
Solution	Expanded Detailed Overview of the Filter Creation Process, including all Conditions and Rules

 

Step 1: Start Creation

1. Navigate to Security Settings > Email > Filter Policies.
2. Select Inbound or Outbound.
3. Click New Filter.
4. Enter a name for your filter.
5. You are presented one more chance to chose inbound or outbound.
6. Click Continue.

Step 2: Scope (Applies only if you are not an End-User)

• The scope is who this rule applies for. There can be various selections
  • Entire organization
  • Single user
  • Groups

Step 3: Select IF Conditions

 

Sender Address	string input, list of keywords separated by comma (,) or semi-colon (;)
Recipient Address	string input, list of keywords separated by comma (,) or semi-colon (;)
Email Size (KB)	A specified size of an email including the attachment to an exact whole number.
Client IP Country	Country list; input a country (This is an auto-fill, so start typing the country name.)
Email Subject	string input, list of keywords separated by comma (,) or semi-colon (;)
Email Headers	string input, list of keywords separated by comma (,) or semi-colon (;)
Email Message Content	string input, list of keywords separated by comma (,) or semi-colon (;)
Raw Email (Up to 10000 Lines)	string input, list of keywords separated by comma (,) or semi-colon (;)
Attachment Type	choose from pre-defined types (see the list of files)
Attachment Name	create a rule based upon a file name/type that is not part of the pre-defined type.
Smart Identifier Scan	See this article for more information about this Data Loss Prevention (DLP) product.
Dictionary Scan	See this article for more information about the Dictionary Scan DLP product

Step 4: Rule Narrative

• See below for the full list of narratives to choose from.

Step 5: Add another Condition (for IF)

• Repeat steps 3 and 4 for adding more than 1 condition

Step 6: Select Do Condition

Quarantine	put in the quarantine (see below for exception)
Allow	does not scan message; will pass to next filter or go onto next scan service.
Nothing	scan message as normal; preferred method if wanting to add additional actions.
Encrypt	only available on Outbound mail flow and if licensed at the company level.

Step 7: Add Another Condition (For DO)

Alert Tech Contact	an email alert would be relayed to the Tech contact address.
Alert Specified Users	Enter an email address or list of email addresses. Separate multiple entries using commas or semi-colons. Wildcard symbols. Email must be on the customer domain.
Hide log	Will hide the email from logs/digest from ALL users (except for Proofpoint Support)
Hide log from Non-admin Users	Will hide the email from logs/digest from all end-users
Stop processing additional filters	Will stop processing any additional filters below this filter
Require admin privileges to release	Requires an administrator to release the email
Enforce completely secure SMTP delivery	Requires a certificate for TLS delivery (Certificate cannot be self-signed or contain errors, and must match the domain exactly on the certificate, excluding a wild card certificate)
Enforce only TLS on SMTP delivery	Does not require a certificate

Override Previous Destination - If selected, this option will ignore the destination that another filter may have applied to this message. This override means we can stop another rule's DO action from performing.

 

Rule Narrative

Upon selecting a condition, the rule narrative will populate based upon the condition.

RULE

• Sender Address – Choose the condition you want to match the sender address to, then enter the string of characters.
  • IS
  • IS NOT
• Recipient Address – Choose the condition you want to match the recipient address to match against, then enter the string of character.
  • IS
  • IS NOT
• Email Size (KB) – The size of the message is either greater or less than a specified whole number.
  • IS GREATER THAN
  • IS LESSER THAN
• Client IP Country – The conditions will compare against the listed country inputted.
  • IS
  • IS NOT
• Email Subject – Choose the condition you want the subject to match against, then enter the string. (This is an EXACT match only.)
  • IS
  • IS NOT
• Email Headers – Choose the condition you want the header to compare with, then enter the string.
  • CONTAIN(S) ALL OF
  • CONTAIN(S) ANY OF
  • CONTAIN(S) NONE OF
• Email Message Content – Choose the condition you want the message body to compare with, then enter the string.
  • CONTAIN(S) ALL OF
  • CONTAIN(S) ANY OF
  • CONTAIN(S) NONE OF
• Raw Email (Up To 10000 Lines) – Choose the condition you want the message body to compare with, then enter the string.
  • CONTAIN(S) ALL OF
  • CONTAIN(S) ANY OF
  • CONTAIN(S) NONE OF
• Attachment Type – Choose what attachment condition you want
  • IS
  • IS NOT
  • Manage (Attachment types)
    • Windows executable components, installers and other vulnerabilities
      • MS executable – *.exe
      • MS binary libraries – *.dll
      • MS executable scrpits – *.bat
      • Visual Basic files – *.vb
      • Other vulnerable MS files – *.ms_vul
      • MS/Installshield Cabinet files - *.cab
    • Other executable components and installers
      • Other executables - *.unix_exe
      • UNIX-like libraries - *.unix_dll
      • Java binaries - *.java
      • OS X DMG files - *.dmg
      • OS X install scripts - *.mpkg
      • Debian/RedHat packages - *.debrpm
    • Office documents and archives
      • MS Office, pre-2007 - *.ms_of
      • XML, Zip, and newer Office documents - *.zipxml
      • MS Access - *.ms_ac
      • Other *Office files - *.doc_other
      • Rich Text Format files - *.rtf
      • Tape archives - *.ar_tape
      • Compressed files - *.ar_file
      • Other compressed archives - *.ar_other
      • PDF files - *.pdf
      • PostScript - *.ps
      • TeX DVI files - *.dvi
      • LaTeX documents - *.lat
    • Audio/Visual
      • Macromedia Flash data - *.flash
      • Images - *.images
      • Vector graphics - *.vgfx
      • Windows Metafiles - *.wmf
      • Cursors and icons - *.ani
      • Multimedia/video containers - *.mmedia
      • MPEG audio/video - *.mpeg
      • RealNetworks audio/video - *.real
      • Windows Media audio - *.wma
      • FLAC audio - *.flac
      • AIFF audio - *.aiff
      • WAVE audio - *.wav
      • MIDI audio - *.midi
      • Any ‘audio/’ MIME type - *m_au
      • Any ‘image/’ MIME type - *.m_im
      • Any ‘video/’ MIME type - *.m_vi
    • Other
      • PGP encrypted data - *.pgp
      • Undecipherable attachments - *.undeciph
• Attachment Name – Choose the condition then enter the string of what you want to proceed with
  • IS
  • IS NOT
• Smart Identifier Scan - See linked KB for this DLP product
• Dictionary Scan - See linked KB for this DLP product