Please take note, that the compliance filter is the top-level rules engine and rules deploy after ~30 minutes. Any rules that are applied at a compliance filter level, will override all modular filtering.
| Expression | Rule Type | Plain text explanation |
| \@.*(\.au) Variant \@.*(\.in.net) |
Advanced | You can use this expression in the From: field of the compliance filter to match any TLD email envelope From: addresses with the .au end suffix all inbound from testdomain.au subdomain.testdomain.com.au |
| \@.*(\.au|\.de)\$ |
Advanced |
You can use this expression in the From: field of the compliance filter to match any TLD envelope From: email addresses with the .au or .de end suffix end expression with \$ to ensure processing ends after the full string |
| (gb2312) |
Header |
You can use this expression to block the Chinese ISO character set as (a header compliance filter rule) |
| 54.124.100.1* |
Advanced | Block specific IP addresses with a wild card |
|
j(ohn)?strange.*
|
Advanced |
Can be used to capture inbound emails to users (To:) An example would be: johnstrange@hornetsecurity.com or jstrange@hornetsecurity.com
The domain is not evaluated, although you can extend the expression domain specific
j(ohn)?strange.*\@hornetsecurity\.com |
|
\@.*(e-marketing.*)
|
Advanced |
Can be used to capture inbound emails to users (From) an envelope senders email address containing the exact words e-marketing within the domain name |
|
\@.*\..*\..*
|
Advanced |
Can be used to capture inbound emails to users (From) an email address from any Sub-domain
Example: @control.hornetsecurity.com @bananas.pork.net @silly.sausage.global |
|
(.docm\b|.xls\b)
Variant: (.xls\b|.xlsm\b|.doc\b)
|
Advanced |
Used to capture multiple file extensions within the compliance filter attachment section Applied and tested with no false positives Warning: you must add the word boundary \b to stop processing otherwise if you define .xls the system will continue to process and look for .xlsm |
| (.*subject1|.*subject2) | Advanced |
Can be used to capture emails with the subject of subject1 or subject2 |
| (\.*ECHOSIGN\b .* please sign\b.*) |
Advanced | Can be used to ensure that several keywords are contained within a subject before a match is applied A single keyword will not activate the rule, This is an inline AND statement |
| (From:.*<.*\anyuser@hotmail.com>.*) Captures MIME From senders |
Header | Can only be used as a header rule. Check your emails header to construct additional rules based upon header entries. Only possible rule to capture MIME senders: The Advanced Rule (From) section captures the envelope sender/reply to address |