Knowledgebase: Outbound Mail Flow
Word matching in Filters and how to prevent false positives
Posted by Walter Addley, Last modified by David Szoke on 19 January 2018 07:04 PM

Proofpoint Essentials Filters will allow you to search for word(s) within parts of the message, including the Email Subject, Email Headers, Email Message Contents, and the entire Raw Email (up to 10,000 lines.)  The Raw Email option will be reviewing all text within the message, including headers, body, and any MIME64 attachments in their encoded state.

The most common way to match these would be a Filter that contains an If statement similar to:

If – Email Message Contents – CONTAIN(S) ANY OF – list, of, words, to, stop

When using a Filter such as this you need to make sure the list of words to stop are as verbose as possible.  Short words, such as the example above of “list, of, words, to, stop” can cause false positives as word boundaries are not used when the message is searched for matches.

An example of a false positive is the example Filter would match the following words, with the match highlighted:

LISTing, kickOFf, WORDSmith, auTOs, nonSTOP

Using full words instead of partial words, along with longer words, will help to prevent false positives.  Searches are also not case sensitive, and will match lower, upper, and mixed case words.

(1 vote(s))
This article was helpful
This article was not helpful

Comments (0)