Creating a keyword filter list

Applies to: Forefront Protection 2010 for SharePoint

You can deny access to SharePoint content that contains certain words in Microsoft Forefront Protection 2010 for SharePoint (FPSP). Keyword filtering helps you to identify unwanted or prohibited content by analyzing the contents of text, Excel, Word, Office 2007 Open-XML, HTML, and PowerPoint files that are uploaded to or downloaded from document libraries. By creating keyword filter lists, you can filter documents of these types based on a variety of words, phrases, and sentences.

To create a new keyword filter list

1. In the Forefront Protection 2010 for SharePoint Administrator Console, click Policy Management, and then under the Filters section, click Filter Lists.

2. In the Filters - Filter Lists pane, click the Create button.

3. In the Filter Wizard, in the Select Filter Type dialog box, select Keyword, and then click Next.

4. In the Filter Details dialog box, specify the filter list name and filter details by following these steps:

   1. In the Filter list name box, type a name for the new list.

   2. In the Filter criteria box, type a word or phrase to be included in the filter list, and then click Add. You can repeat this step in order to add multiple words or phrases, or you can add multiple words or phrases on the same line, provided that they are separated by a comma. There is no limit to the number of items that you can include in the list.

      Note

      You can edit items in a filter list by double-clicking and editing an item, and then pressing ENTER. You can remove items from a filter list by selecting an item and then clicking Remove. You can also import and export items into a filter list. For more information, see Exporting items from a filter list) and Importing items into a filter list. For more information about syntax rules, see About keyword filter list syntax rules.

   3. Click Next.

5. In the Realtime Scan, Scheduled Scan, and On-Demand Scan dialog boxes, configure how you want the filter list to be applied (to the realtime, scheduled, and on-demand scans) by following these steps:

   1. Enable the filter list for use with a scan job by using the Enabled drop-down list and selecting Yes. Filter lists are enabled by default.

   2. Configure the action that FPSP should take when a keyword filter is matched by using the Action drop-down list for each scan job.

      For more information about these actions, see Configuring the action when a filter is matched.

   3. To configure FPSP to quarantine files when the filter is matched, using the Quarantine files drop-down list, click Yes. Quarantining for filters is enabled by default. Enabling quarantining causes deleted files to be stored, permitting you to recover them.

   4. To configure notifications when the filter is matched, using the Notifications drop-down list, you can select Never send notifications to prevent the sending of the File filter matched notification, even if it is enabled. Otherwise, FPSP uses the configured File filter matched notification settings; Use notification settings is the default.

   5. Click Create.

      The keyword filter list you just created appears on the Filters - Filter Lists pane.

   6. Indicate the Minimum unique keyword hits. This setting enables you to specify how many unique keywords must be matched for the action to be taken. The default is one (1). For example, you have set the minimum unique keyword hits value to 3. The word "wonderful", which is in the list, appears three times in the message. However, no other keyword in the list appears at all. The keyword filter has not been matched, because only one keyword in the list was matched when a minimum of three are required.

6. In the Filters - Filter Lists, pane click Save.

For more information about viewing and managing this filter list and others, see Viewing and managing filter lists.

See Also

Concepts

Using example keyword lists
Enabling case-sensitive keyword filtering
About keyword filter list syntax rules