Properties tab

Define the threshold and email fields in which the specific classifier will be searched.

Field Description
Threshold

A condition’s threshold is the number of matches that trigger an incident. Select one of the following:

  • At least - select the minimum number of matches that must be made. Valid values are 1-999.
  • Between - select an exact range of matches that must be made. Valid values are 1-999.
  • No match exists - trigger the rule if there are no matches.
Email Fields Click Email Fields to view and select the email fields to search for this condition.
Search in all the email fields Select to search the entire email message for the key phrase, regular expression, or dictionary terms. This is the default.
Search only in these fields

Select to search only specific parts of the email message. Choose one or more of the following:

  • Attachment - search only in email attachments
  • Subject - search only in the subject line of the email message
  • Body - search only in the main body of the email message
  • From - search only in the From field of the email message
  • To - search only in the To field of the email message
  • Cc - search only in the carbon copy field of the email message
  • Bcc - search only in the blind carbon copy field of the email message
  • Other header - search in any other headers that are not covered by the above options. This includes all x-headers. You can either search in all other headers, or define a specific header that you want to search.