Managing dictionaries

Dictionaries are used to define phrases that are used in lexical rules, used for inbound and outbound email content filtering. (See Content Filter tab).

Forcepoint Email Security Cloud defines two types of dictionary: those that are predefined and your custom dictionaries. The former are maintained by Forcepoint and include common profanities; dictionaries relating to categories such as finance, gambling, and shopping; and compliance rules for payment card information and Social Security numbers. You can exclude phrases from these lists (see Excluding phrases from a dictionary) but you cannot include additional words or phrases; if you need to add phrases, system dictionaries can be embedded inside your own dictionaries.

Once defined, a phrase is available for use with both inbound and outbound lexical rules across all policies.

You can add 3 types of phrase to a custom dictionary:

• A simple string, for example “project rhine”.
• A complex multi-word search. This option searches on different variations of the phrase you define; for example if you enter “confidential email”, a lexical rule might match the exact phrase or any instances of the words “confidential” and “email” appearing close to each other in a message. See Advanced dictionary configuration for more examples.
• A regular expression. See Including regular expressions.

Assign each phrase that you add a score. This is used to determine the disposition in a lexical rule: typically a higher score indicates a worse contravention of the rule. When the rule is used analyze a message, the scores of all matching phrases are summed and the total is measured against the lexical rule threshold value.

Phrases can have positive values (meaning they increase the likelihood of the rule being triggered), negative values (meaning they decrease this likelihood), or a zero value (meaning they have no effect on the total value).

You can also select the following options instead of a numerical score:

• Always trap this phrase – assigns a score of +20 to the phrase, making it likely that a message will exceed your configured threshold.
• Always let through – assigns a score of -20 to the phrase, making it unlikely that a message will exceed your configured threshold.
• Ignore this phrase – assigns a score of 0 to the phrase, meaning that the phrase will not influence whether a message exceeds your configured threshold.

For instructions on how to configure lexical rules and threshold values for your policies, see Creating a lexical rule in advanced mode.