This article explains how to use Mimecast Content Examination (CEX) policies and regular expressions (regex) to identify and control emails that contain specific language character sets. It describes how to configure definitions and policies, available language script patterns, and important considerations when using language-based filtering.
Overview
Mimecast Content Examination policies can be configured to filter emails based on language scripts by using custom regex patterns. Administrators can add Unicode-based regex to Content Definitions to match specific character sets, such as Arabic, Cyrillic, Chinese, Hebrew, and others, and then apply these definitions in Content Examination policies. These configurations are created and managed in the Mimecast Administration Console Workspace under the Content Examination policy area.
Considerations
When using regex to detect language scripts, administrators should use Unicode-based patterns for comprehensive character matching and test each definition carefully. Language-based blocking can produce many false positives because legitimate contacts may use email content or providers in many countries. Broad selections, such as Latin script, can block multiple languages including English, French, and German. Some configurations may use patterns that detect only non-alphanumeric or non-English character sets. To reduce false positives, you can combine language regexes with content keywords so that messages are only acted on when both the language pattern and specific words are present, or use qualifiers and exclusions to fine-tune triggers. Administrators should monitor policy results and adjust scoring or conditions if necessary.
Prerequisites
To configure language-based Content Examination in Mimecast, you must:
Have access to the Mimecast Administration Console Workspace.
Have permission to create or edit Content Examination definitions and policies.
Be familiar with adding regex patterns to the Word / Phrase Match List and setting policy actions such as hold, bounce, or delete in Content Examination policies.
Using regex to match language scripts
Content Examination policies can use custom regex to define rules for catching specific characters or language scripts. The recommended approach is to use Unicode-based regex patterns, which allow comprehensive matching of scripts associated with particular languages. For example, you can use patterns based on Unicode script names to match emails containing specific scripts. One example pattern for Chinese characters is \p{Han}. The same format applies to other Unicode script names such as \p{Arabic}, \p{Cyrillic}, \p{Latin}, \p{Hangul}, and \p{Hebrew}. These regex patterns can be entered as lines in the Word / Phrase Match List of a Content Definition to match the corresponding character sets.
Creating language-based Content Examination definitions and policies
To create a Content Examination definition and policy that filters emails based on language characters, you can configure the following settings in the Mimecast Administration Console Workspace:
Navigate to Gateway | Policies | Content Examination | New Policy.
Use the lookup option to select an existing Content Definition or create a new one if needed.
When creating a new Content Definition for language detection, configure it as follows:
Add a Description and set the Activation Score to 1.
In the Word / Phrase Match List, enter one or more regex lines to match the desired language scripts.
Choose which contents to scan, such as the message subject, body, and other available parts.
After defining the regex patterns and scan targets, set the Policy Action for the Content Examination policy. Available actions include options such as hold, bounce, or delete, and you can also configure notifications. Applying the policy from External Addresses to the target recipient or internal addresses allows you to filter messages that contain the specified language scripts. Policies can be configured to hold emails whose subject or body contains specific registration-style keywords and to hold or block messages that appear to be in foreign scripts or non-English languages. Content Examination policies can therefore target attack characteristics, including subject or body keywords and foreign or non-English scripts, by using the regex patterns described above.
Field / Option | Description |
Word / Phrase Match List | Enter regex lines that match language scripts, such as |
Contents to scan | Select which parts of the message to inspect, such as the subject and body, so the regex patterns can detect the targeted character sets. |
Policy Action | Choose how Mimecast should handle matching messages, for example hold, bounce, delete, or similar actions, and configure any related notifications. |
Applies From / Applies To | Configure the policy scope (for example, from External Addresses to specific internal recipients) so that emails containing the selected language scripts are filtered for the intended senders and recipients. |
Q: | Can Mimecast Content Examination policies be used to filter emails based on language? |
A: | Yes. You can create Content Examination policies that filter emails based on language scripts by using regex patterns that match specific Unicode character sets. For instance, you can use script properties such as |
Q: | How can I reduce false positives when blocking or holding emails based on language scripts? |
A: | To reduce false positives, combine language regex patterns with additional content keywords so that both the language script and specific terms must be present for the policy to trigger. You can also use qualifiers and exclusions in your Content Examination configuration and monitor results to adjust scores or conditions as needed. |
Comments
Please sign in to leave a comment.