Skip to main content

SpamTitan

Creating a Pattern Filter

Follow the steps below to create a new pattern filter in SpamTitan.

For information on creating a meta pattern filter, which combines multiple rules that have been created using the Test Mode rule type, see Creating a Meta Rule Pattern Filter.

  1. Log into SpamTitan as a Global Admin.

    Note

    By default, pattern filtering is disabled for Domain Group Administrators and Domain Administrators but can be enabled for these roles by your account's Global Administrator.

  2. Go to Filter Rules > Pattern Filtering and the Pattern Filters window displays:

    ST-pattern-filters.jpg

    You can use the filter bar at the top of the Pattern Filter list to view only one or a combination of filter types:

    ST-pattern_filters-filter.jpg

  3. Click Add... and the Pattern window displays:

    ST-add-pattern-filter.jpg

  4. Using the table below as a reference, complete the fields in the Pattern window. 

    Note

    If you want to create a Meta Pattern Filter, you must first create individual pattern filters using the Test Mode rule type that you can then combine to create a Meta pattern filter.

  5. Click Save to save your pattern, or Cancel to discard it.

Pattern Settings

Field

Description

Filter Expression:

This is how the pattern filter will be evaluated. All expressions are case-insensitive.

Starts with

The body or header must start with this value.

Ends with

The body or header must end with this value.

Contains

The body or header must contain this value.

Equals

The body or header must be exactly equal to this value.

Matches any word in

Enter a list of words separated by a comma. If any word on the list is in the body or header, the pattern filter will trigger.

Matches regular expression

Enter a regular expression to match against the body or header. See https://www.regular-expressions.info for information on using regular expression.

Matches multiple rules

Select this option to match multiple rules you have already created using the Test Mode rule type. See Creating a Meta Rule Pattern Filter.

Apply to Body:

Check for this test to trigger on the body of an email.

Use Rawbody

Check this to allow your body rules to trigger on the HTML of an email. 

"The rawbody directive defines a test to be applied to the text of a message, as it would be likely to appear to a person reading the message in an HTML-based mail client. The Subject header is not included. All textual MIME components of the message are decoded, and the message is split into lines based on the line breaks in the message. The test is then applied to each message line."

Excerpt from SpamAssassin, by Alan Schwartz (2004)

Warning

Rawbody tests can cause excessive CPU usage and cause mail queues, so use with caution.

Apply to Headers:

Check this to enter a header (one per line) for the pattern filter to trigger on. Leave empty to trigger on any header. 

Enter one header per line. Syntax is either From or From:.

Any email header can be entered here, e.g. To, From, Cc, Subject, ALL, X-Header-From-Another-Box, Received. See this wiki for a list of common headers.

Special header rules are as follows:

EnvelopeFrom

Triggers on the Envelope MAIL FROM instead of the From header.

ToCc

Triggers on both the To and Cc headers.

ALL

The rule will trigger on any header.

There are also three options available to append to a header:

:raw

Append to the end of a header to prevent decoding of quoted-printable or base64 encoded headers.

:addr

Append to the end of a From or To header to make the rule only trigger on the address in the header.

:name

Append to the end of a From or To header to make the rule only trigger on the name in the header.

Rule Type:

Determines how the test should be scored/treated.

Test Mode

Test Mode does not affect the score of the mail, it is used to create meta pattern filters with "Matches multiple rules".

Hard Block

Adds a score of 100 to the email, causing it to be blocked.

Hard Allow

Subtracts a score of 100 from an email, causing it to be allowed.

Soft Block

Adds a configurable positive score, between 0.01 and 99.99 (default: 5).

Soft Allow

Subtracts a configurable negative score, between -0.01 and -99.99 (default: 5).

Comment:

Add additional notes for the rule.

Disable Rule:

Check to prevent a rule from triggering without deleting the rule.

In this section: