How do I use Text Censor Scripts Operators?

This article applies to:

• Trustwave MailMarshal (SEG)/SEG (7.1.2 and below)
  • Note syntax has changed in MailMarshal SEG 7.2 and above - see the User Guide.
• Trustwave ECM/MailMarshal Exchange
• WebMarshal (6.9.2 and below)
  • Note that syntax has changed in WebMarshal 6.9.6 and above - see the User Guide.

Note:

This article applies to unsupported legacy versions of SEG and WebMarshal. Current information for these products is in the respective User Guides.

Question:

Procedure:

Operators greatly increase the power and flexibility of TextCensor scripts. Each line in a TextCensor script is a search statement. This can simply be a single keyword, or a complex statement using operators.

There are five operators. Each operator returns a True if...

• AND    ...conditions both before and after AND are true
• NOT    ...keyword following NOT is not found
• INSTANCES=    ...keyword occurs a given amount of times
• FOLLOWEDBY=    ...keyword before FOLLOWEDBY is followed by keyword after FOLLOWEDBY.
• NEAR=    ...keywords before and after NEAR are found near each other.

If 'win' if found within 5 words of 'cash', irrespective of which occurs first, a True is passed to the second part of the statement. Then if 'free' is also found, the statement returns a True. Could be used to detect Spam.

If 'free' occurs twice in the message, AND there is an occurrence of 'order now' a True is returned. Use against unsolicited selling.

If look* forward is NOT found (where * is a wildcard), a True is passed to the second part of the statement. Then if 'forward' is followed within 5 words by 'everyone', the statement returns a True. This would be used to detect hoax messages, while excluding genuine message that might contain something like 'Looking forward to hearing how everyone got on'. Advanced statements like this may be needed to give more accurate triggering for Spam.

This article was previously published as:

NETIQKB29081

Marshal KB63