Content Dictionary - Negative Weighting

rhallett_ironport · ‎08-14-2008

I am using a dictionary and content filter to find emails that contain certain terms such as: account number, member number, etc..

I am running into an issue where I have a particular email that has a WORD document that contains the following line:

account number is 123456

Now I don't want this to trigger my filter (because the account number is obviously not legitimate)

In my content dictionary I have the following lines

account number is \d+ Weight of 8
account number is 123456 Weight of 1

Unfortunately I am getting two hits on the dictionary for a total weight of 9, instead of the weight I want which is 1.

Is there any possible way to do negative weight in IronPort. For example:

account number is \d+ Weight of 8
account number is 123456 Weight of -8

Now, the one dictionary entry will cancel out the other. This also gives me the benefit of still getting hits on other items in the dictionary.

Is this possible with IronPort?

vkoutsou_ironport · ‎08-15-2008

Unfortunately you cannot use negative wights for your dictionary, so I am afraid your approach will not work.
If the message that has this Word document is recurring, you may consider creating a separate mail policy for it where the content filter with the dictionary is not enabled.

lrosenstein · ‎08-18-2008

account number is \d+            Weight of 8
account number is 123456         Weight of 1

You can use the following line in your dictionary:

account number is (?!123456)\d+

This will match the phrase "account number is" followed by a number that is not "123456".