Filtering

Dr.Web allows you to use a filtering system to reduce the server load in case of spam attacks by taking the unnecessary messages out of the server transport system before they are checked for viruses and spam. For effective filtering, creating an optimal filtering rules set without contradictory or excess rules is essential.

Before filtering, the group which sender of the message belongs to is identified. If the sender belongs to one of the created groups, filtering rules specified in the profile corresponding to this group will be applied to the message. If the sender does not belong to any groups, settings of the Default profile will be applied to the message. Therefore, if it is necessary to apply the filtering rule to all the messages not included in groups, create this rule in the Default profile settings.

If the sender profile does not contain any limits, the message is filtered by the rules created for the recipients addresses. Every address from the recipients list relates to its own group (an AD group or a list of email addresses), and every group has its own profile assigned to it. The profile with the highest priority is applied. Therefore, if you want to set limitations on a created group of recipients, do not create filtering rules in the Default profile, but create a separate profile to assign to this group.

At first every message is processed by the anti-spam transport agent. At this stage the filtering rules are applied to the message as to the whole entity. Messages are filtered by the number of senders and recipient, by subject, number of attachments, etc. After the filtering, unfiltered messages are checked for spam (see Figure 8).

After checking for spam, the message is processed by the anti-virus agent. At this stage the filtering rules are applied to the message as to the set of files, the message body is considered as a file too. Messages are filtered by file size, name, extension, etc. After the filtering, unfiltered messages are checked for viruses (see Figure 8).

Figure 8. Filtering messages in the transport system

The traffic filtering is configured in the Filtering pane (see Figure 9). Filters are applied according to certain rules which can be added by the administrator. These rules determine the conditions for the filtering by the properties of messages and their attachments.

Figure 9. Filtering pane

If you are working with the Filtering component for the first time, the list of rules will be empty. You can create and configure filtering rules.

To configure message filtering

1.Select Enable filteringat the top of the Filtering pane. This makes the parameters in the section available for editing.

You can apply fileting rules to either the source or to the recipient, or to both source and recipient.
For example, you can create a rule for the message subjects that includes the word “Attention”. If you set this rule for the source only, you will not be able to send messages with the word “Attention” in the subject. If you set this rule for the recipient, you will not be able to receive messages with the word Attention in the subject. If you set this rule for both source and recipient, you will not be able to receive nor to send messages with the word “Attention” in the subject.

2.Enable one or more filters from the list by selecting the corresponding check boxes. If the list of filters is empty, you can create them.

3.Select the actions for the email messages with attachments on the Attachment settings section.

For the messages, you can select one of the following actions:

•Delete—to delete message.

•Add prefix to subject—to let the message through and add to its subject a prefix specified in the Subject prefix.

For attachments, the following actions are available:

•Move to quarantine—to isolate the attachment in quarantine.

•Delete—to delete the attachment.

In the Subject prefix field, specify the prefix added to the subject of the filtered message. The default prefix is ***FILTERED***.

In the File name suffix field, specify the suffix added to the name of the text file attached to the filtered message. The default suffix is _filtered.txt.

In the File contents field, enter the text of the file added to the filtered message. While editing the text, you can add macros from the Macros drop-down list.

To create a filtering rule

1.Click Add under the filters list. A Filter rule window will open (see Figure 10). You can enter the name of the rule and specify its conditions in this window.

Figure 10. Configure filtering rule

2.To add a condition, click Add. In the new window, select the condition type, specify the value and the type of compliance with the specified value. The types of conditions, compliance and possible values are listed in the table below:

Once a condition is added to a filtering rule, it is converted into a string with certain operators. Their descriptions are listed in the table below:

3.To delete or edit any of the specified conditions, select it in the list and click Delete or Edit respectively.

Example of the file size filtering rule

Figure 11. Example of the file size filtering rule

Example of the file name filtering rule

Figure 12. Example of the file name filtering rule

Example of the subject filtering rule

Figure 13. Example of the subject filtering rule

To edit or delete an existing filtering rule

1.Select the rule in the list of filters an click Edit or Delete under the list.

2.Click Save when you are done configuring the filtering rules.