This article applies to:
- Trustwave MailMarshal (SEG)/SEG (7.1.2 and below)
- Note syntax has changed in MailMarshal SEG 7.2 and above - see the User Guide.
- Trustwave ECM/MailMarshal Exchange
- WebMarshal (6.9.2 and below)
- Note that syntax has changed in WebMarshal 6.9.6 and above - see the User Guide.
Note:
This article applies to unsupported legacy versions of SEG and WebMarshal. Current information for these products is in the respective User Guides.
Question:
How do I use Text Censor Script Operators?
Procedure:
Operators greatly increase the power and flexibility of TextCensor scripts. Each line in a TextCensor script is a search statement. This can simply be a single keyword, or a complex statement using operators.
There are five operators. Each operator returns a True if...
- AND ...conditions both before and after AND are true
- NOT ...keyword following NOT is not found
- INSTANCES= ...keyword occurs a given amount of times
- FOLLOWEDBY= ...keyword before FOLLOWEDBY is followed by keyword after FOLLOWEDBY.
- NEAR= ...keywords before and after NEAR are found near each other.
Each search statement is computed from left to right.
The best way to explain the way Operators work is to look at some basic examples.
send this FOLLOWEDBY=5 everyone
If 'everyone' follows within 5 words of 'send this' the statement returns a True. Could be used to check for hoaxes.
win NEAR=5 cash AND free
If 'win' if found within 5 words of 'cash', irrespective of which occurs first, a True is passed to the second part of the statement. Then if 'free' is also found, the statement returns a True. Could be used to detect Spam.
free INSTANCES=2 AND order now
If 'free' occurs twice in the message, AND there is an occurrence of 'order now' a True is returned. Use against unsolicited selling.
NOT look* forward AND (forward FOLLOWEDBY=5 everyone)
If look* forward is NOT found (where * is a wildcard), a True is passed to the second part of the statement. Then if 'forward' is followed within 5 words by 'everyone', the statement returns a True. This would be used to detect hoax messages, while excluding genuine message that might contain something like 'Looking forward to hearing how everyone got on'. Advanced statements like this may be needed to give more accurate triggering for Spam.
- This article was previously published as:
- NETIQKB29081
- Marshal KB63
