Forum Discussion

cllee's avatar
cllee
Brass Contributor
Apr 23, 2020

Applying 2 rules on 1 single email

Hi,

I would like to create 2 rules to captured suspicious email by having two different action:
1) Edit the mail subject to redirect the email to me, so that I can get a notification.
2) Send the suspicious email to Quarantine.

I have set the first rule on higher priority and unchecked "Stop processing more rules". Assuming that it will first redirect the email to me, and move on to second rule to quarantine the email.

However upon testing the scenario. The email was quarantine without redirecting a copy of the email to me. Am I doing this right? Anyway to achieve the above scenario?

Thanks.

  • HidMov's avatar
    HidMov
    Steel Contributor

    Hi cllee 

     

    Can you run through the two rules you've set up exactly? 

     

    Thanks,
    Mark

    • cllee's avatar
      cllee
      Brass Contributor

      HidMov 

      I tested the following 2 rules:
      Rule 1: Preppend subject, redirect/BCC email to me
      Rule 2: Send the mail to Quarantine (without the prepend subject)

      Currently the email hit both the rules, but it doesn't send  the mail to me (based on Rule 1).

      The mail actually got quarantine with the prepend subject. Hence i believe it has hit both the Rule 1 and Rule 2.

  • cllee 

     

    Consolidate your rules into one rule then use the following actions in your transport rule.

     

    Prepend the subject with 'Your Message: '
    and Deliver the message to the hosted quarantine.
    and Send the incident report to yourMailbox@yourdomain.com, include these message properties in the report: original mail

    • cllee's avatar
      cllee
      Brass Contributor

      Michael_Larrivee 

       

      I do not want the quarantine email to tagged with the Appended subject. Reason being if i were to release the email back to the user from quarantine. The original subject is intact.

      Hence the reason I wanted to create 2 separate rules, one of it is to achieve the prepend subject and redirect to me. So that i can get a notification if the rules is violated.


  • HidMov's avatar
    HidMov
    Steel Contributor

    cllee 

     

    I'll see if I can replicate - it feels like the anti phish policy and transport rules are competing with each other. Are there two emails in the quarantine? 

    • cllee's avatar
      cllee
      Brass Contributor

      HidMov 

       

      Thanks. There is only one mail quarantine based on the transport rules i created. 

Resources