This article applies to:
- Trustwave MailMarshal (SEG)
- Trustwave ECM/MailMarshal Exchange 7.X
Question:
How do I create a rule to detect Social Security Numbers?
Procedure:
In order to detect US Social Security Numbers (SSN), you can use TextCensor or create an XML Category Script file that can be used in a rule.
- With SEG 7.2 and above:
- You can use the Social Security category script found in a new installation by default. You can also download this script from the SEG sample scripts page.
- You can use a TextCensor script. Include the special class [US-SSN]. See Help for details.
- With ECM and earlier versions of SEG, see the script below.
- Note: This script below is updated and differs from that provided in the default configuration of SEG/MailMarshal versions below 7.2.
- Default configuration includes a rule to use this script (in the Policy Management ruleset).
To create this XML file, open a text editor and copy the text below:
<?xml version="1.0" encoding="utf-8" ?>
<MailMarshal Version="6.8" Date="08/09/2010">
<SpamConfig Name="SocialSecurity" Description="Social Security Numbers">
<!--Looks for Social Security numbers in messages and attachments. -->
<Configuration>
<Config Name="TriggerLevel" Data="60" />
</Configuration>
<!--Subject line rules-->
<RegExpHeader>
<RE_Header Name="RH_SUB_SSN" Data="\b(?!000)(?:[0-6]\d{2}|7[0-2]\d|73[0-3]|7[5-6]\d|77[01])([\x20-])(?!00)\d{2}\1(?!0000)\d{4}\b" Field="Subject" Case="false" Description="Suspected SSN number found in subject" Score="60" />
</RegExpHeader>
<!--Body rules-->
<RegExpBody>
<RE_Body Name="RB_BDY_SSN" Data="\b(?!000)(?:[0-6]\d{2}|7[0-2]\d|73[0-3]|7[5-6]\d|77[01])([\x20-])(?!00)\d{2}\1(?!0000)\d{4}\b" BodyPart="Both" Case="false" Description="Suspected SSN number found in body" Score="60" />
</RegExpBody>
<!--Attachment rules-->
<Evaluations>
<Eval Name="EV_TXT_SSN" Score="60" Library="Config\spamevals.dll" Type="Attachment" FileType="TEXT" RESearch="\b(?!000)(?:[0-6]\d{2}|7[0-2]\d|73[0-3]|7[5-6]\d|77[01])([\x20-])(?!00)\d{2}\1(?!0000)\d{4}\b" Description="Suspected SSN number found in attachment" Case="True" />
</Evaluations>
</SpamConfig>
</MailMarshal>>
Save the textfile as SocialSecurity.txt then rename the file extension from .txt to .xml. Place this file in the MailMarshal Config folder (subfolder \Config\ within the MailMarshal installation - Array Manager for 6.0 and above).
Once the SocialSecurity.xml file has been created and placed in the MailMarshal Config folder, verify that you have a rule enabled to use it.
To apply the change, when you have created or verified the rule, commit configuration and restart email processing services.
Notes:
- The Attachment checking (Evaluations section in the XML above) works with MailMarshal SMTP/SEG 6.7 and above and MailMarshal Exchange 7.X.
- If you are creating a new rule, use the rule condition Where message is categorized as and select the SocialSecurity.xml option.
Be aware that XML files are case sensitive.
It is recommended with any changes to the MailMarshal Configuration that you make backups both before and after the changes. See Q10928, How do I back up my MailMarshal configuration?
- This article was previously published as:
- NETIQKB35474