Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

National Insurance Content Filter Help

I am after some help.

We are using the RegEx provided by IronPort to do some testing and are scanning all outbound messages using this RegEx.

However we have got forms that go out to customers that by the Natioanl Insurance number request field there is a NI Number to show an example (AB123435C). This of course then triggers the content filter and the message is incorrectly stopped.

We want to try and stop this from happening as it is going to casue major issues with false positives. We have thought about adding a rule that if AB123435C "is Not" contained within the message body or attachment, but this would mean that if someone were to email out a completed form that had both the sample NI number and the customers correct NI number then it would be ignored, which of course is unacceptable.

The only way I can see to do this, is to add to the dictionary (or create a new one) that contains AB123435C with a Minus score that equals the score that the RegEx gives it.

So if the RegEx give a score of 1, then the AB123435C entry would have to give a score of -1. This would mean that the example NI would be ignored, but any real NI numbers would still be picked up.

The problem is that I don't think there is the feature to give minus scores to dictionary terms. Has anyone else either requested this or have a better idea?

Thanks in advance.


Re: National Insurance Content Filter Help

Just an idea, cos I haven't played with threshold scoring.

You dont need negative score. According to the manual, you can set "weight" to keywords in dictionary.

All you need is a very big weight difference between the "example-NI" score and the normal NI score.


example-ni score is 1.
other regex matched NI is score 9999 (I assume this can be done).

Then your minimum score of the filter rule set to 100 is sufficient to catch any email try to get through by passing the example form. (unless they attached it 100 times).

Once an email is attached with a normal form, they _should_ be caught because 9999 is assigned and > 100.

New Member

Re: National Insurance Content Filter Help

We have thought about adding a rule that if AB123435C "is Not" contained within the message body or attachment, 

You can probably do this with a negative assertion. For example if you add the following to the beginning of your existing regex:


Then the regex will match all numbers except "AB123435C".