Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

About the Keyword
Search tab
Chapter 6: Configuring Application Defenses
Creating Mail (Sendmail) Application Defenses
The Keyword Search tab allows you to configure the Sidewinder G2 to perform
a search for specified character set(s), or key words, within an e-mail
message. The search scans the message’s header and body sections. If the
mail body contains mime encoded attachments, the encoded attachments are
scanned. If the filter finds a specific number of key word matches, the message
is rejected. If the filter does not match a specific number of key words, it passes
the message onto the next filter or to the intended recipient.
Select your key words carefully. For best results:
• Use spaces before and after each defined phrase.
• Create a comprehensive list of phrases instead of relying on wildcard-like
searching.
• Note that key word searching is most reliable on MIME attachments with
ASCII content-types. If dealing with non-ASCII types of attachments, false
positives are likely if the length of the key words are short and the
attachments are long.
Following these guidelines can decrease the chance of mistakenly rejecting a
legitimate message.
To configure character sets to search for, follow the steps below.
1 Verify that kmvfilter server is enabled in the appropriate burbs (Services
Configuration > Servers).
2 In the Minimum Number of Phrase Matches Required for Rejection of
Message field, specify the number of key word matches that must be found
in a message before it is rejected.
3 In the Total Number of Phrase Matches to Verify Before Rejection field,
specify whether the filter will search the entire message for key words, or
whether it will stop searching for key words if the minimum number of
matches is met:
• Minimum—Select this option if you want the filter to stop searching and
fail the message if the minimum number of key word matches is met.
This is based on the number that you enter in the previous step. The
filter will reject a mail message once the minimum number of key words
are matched.
• All—Select this option if you want the filter to continue searching the
message for key words after the minimum number of key word matches
is met, for auditing purposes. After searching the entire message for key
word matches, the message is rejected.
4 The Phrase List table provides the list of phrases that will be filtered for this
Application Defense. The table contains three columns:
• Before—This column indicates whether a space is required immediately
before the specified phrase to match the filter. An asterisk (*) indicates
that the phrase will not match unless there is a space immediately in
front of the phrase.
175