Apr 23 2020 01:18 AM
Hi,
I would like to create 2 rules to captured suspicious email by having two different action:
1) Edit the mail subject to redirect the email to me, so that I can get a notification.
2) Send the suspicious email to Quarantine.
I have set the first rule on higher priority and unchecked "Stop processing more rules". Assuming that it will first redirect the email to me, and move on to second rule to quarantine the email.
However upon testing the scenario. The email was quarantine without redirecting a copy of the email to me. Am I doing this right? Anyway to achieve the above scenario?
Thanks.
Apr 23 2020 04:24 AM
Apr 23 2020 04:31 AM - edited Apr 23 2020 04:35 AM
Consolidate your rules into one rule then use the following actions in your transport rule.
Prepend the subject with 'Your Message: '
and Deliver the message to the hosted quarantine.
and Send the incident report to yourMailbox@yourdomain.com, include these message properties in the report: original mail
Apr 23 2020 05:26 AM
I do not want the quarantine email to tagged with the Appended subject. Reason being if i were to release the email back to the user from quarantine. The original subject is intact.
Hence the reason I wanted to create 2 separate rules, one of it is to achieve the prepend subject and redirect to me. So that i can get a notification if the rules is violated.
Apr 23 2020 05:29 AM
@HidMov
I tested the following 2 rules:
Rule 1: Preppend subject, redirect/BCC email to me
Rule 2: Send the mail to Quarantine (without the prepend subject)
Currently the email hit both the rules, but it doesn't send the mail to me (based on Rule 1).
The mail actually got quarantine with the prepend subject. Hence i believe it has hit both the Rule 1 and Rule 2.
Apr 23 2020 02:48 PM
I'll see if I can replicate - it feels like the anti phish policy and transport rules are competing with each other. Are there two emails in the quarantine?
Apr 23 2020 10:52 PM