How do I set up TextCensor?

This article applies to:

• Trustwave MailMarshal (SEG)
• Trustwave ECM/MailMarshal Exchange

Question:

How do I set up TextCensor?

Procedure:

• Phrases associated with Hoax or Chain e-mails
• Phrases associated with spam
• Harmful commands associated with VBS and other viruses
• Abusive and offensive words
• Any other message or header text you want to identify and act on

There are two stages involved in setting up a TextCensor Rule.

1. In the Configurator or MailMarshal (SEG) 10 Management Console, create a new TextCensor Script and enter the keywords that you want to detect. Example scripts are included in the product installation. Customers who are upgrading from much older versions can obtain updated scripts from the TextCensor Script page in the Support area of the Trustwave website (requires login).
2. Create a rule that invokes the Text Censor Script. A typical rule might be as follows:

   "Where message triggers text censor scripts, move message to spam folder"

Hoax and Chain E-mails

Hoax and Chain e-mails are detected by simply looking for combinations of phrases such as "e-mail this" in the same e-mail as "everyone". 100% detection is impossible due to the varying nature of these e-mails. A sample script to detect hoaxes is included with the products. This script can be made more sensitive by adding extra criteria. 

• Note that the primary detection method for all spam and spam hoax messages is the SpamCensor facility.

Be mindful of the fact that a balance needs to be struck between high sensitivity and an increased rate of triggering by harmless e-mail (False Triggering).

Spam

Spam comes in all shapes and sizes. The SpamCensor and SpamProfiler facilities in SEG are the primary method for blocking of spam, but you can also use TextCensor for spacial cases.

• For advice on implementing a spam protection policy, see article Q10810: What are MailMarshal anti-spam best practices?

Viruses and malware

A virus scanning plug-in and use of SpamCensor are absolutely essential for malware protection. TextCensor can sometimes assist with detection of known keywords associated with an outbreak.

Notes:

• When entering in a TextCensor Script each part of the Script text must be on a new line. Each line of the TextCensor Script is considered to be a statement.
• For more complex and accurate TextCensor Scripts, you can use a number of operators. See the User Guide or Help for the specific product version. Note that SEG 7.2 and above uses an enhanced TextCensor syntax.
• For more information about detecting VBS type viruses, see article Q10483: How do I stop viruses with SEG?
• New versions of the products often include updated TextCensor scripts. Upgrade does not change existing scripts. Customers can obtain updated scripts from the TextCensor Script page in the Support area of the Trustwave website (requires login).
  

This article was previously published as:

NETIQKB29077

Marshal KB57