Enabling keyword filtering

Applies to: Forefront Security for Exchange Server

After you have created a keyword list, you must enable it.

To enable keyword filtering

1. In the Shuttle Navigator, click FILTERING.

2. Click the Keyword icon. The Keyword Filtering work pane appears.

3. Select the Transport Scan Job. (Keyword filtering only works with the Transport Scan Job.)

4. In the Keyword Fields section, select Message Body.

5. Select one of the filter lists you have created.

6. Using the Filter field, set the filter to Enabled.

7. Set the Keyword filtering action.

8. Indicate whether you would like to send notifications (for the procedures to configure notifications, see Sending e-mail notifications), quarantine identified files, and scan inbound, outbound, or internal mail.

9. Indicate if you would like to Quarantine identified files. Enabling quarantine causes deleted attachments and purged messages to be stored, permitting you to recover them. However, worm-purged messages are not recoverable.

10. Indicate what combination of Inbound, Outbound, and Internal mail should be scanned.

11. Indicate the Minimum Unique Keyword Hits. This setting enables you to specify how many unique keywords must be matched for the action to be taken. The default is one 1. For example, you have set the minimum unique keyword hits value to 3. The word “wonderful”, which is in the list, appears three times in the message. However, no other word in the list appears at all. The keyword filter has not been matched, because only one term in the list was matched.

12. Save your changes.