Tags

,


Courtsey-http://technet.microsoft.com/en-us/library/ff715197.aspx

Applies to: Forefront Online Protection for Exchange

By using the Filters repository, you can add and manage large lists of values for multiple policy rules. The Filters repository includes the following:

  • Upload large lists. Large lists are called Dictionaries in the repository. These lists can contain IP addresses, domains, e-mail addresses, keywords, and file names and extensions that you want to quickly use in various policy rules. Utilizing these lists can be faster than manually entering hundreds of keywords or e-mail addresses in the policy rule editor.
  • Download dictionaries. Dictionaries can be downloaded from within the Filters tab by clicking the dictionary name.
  • Replace dictionaries. Any dictionary can be replaced, even if it is currently associated with a policy rule. In this case, all policy rules using the dictionary that is replaced will be updated with the new values.
  • Delete dictionaries. Dictionaries can be used in multiple policy rules. Therefore, deleting them from the Filters repository would cause a change of behavior in the associated policy rules and a potentially undesirable impact on the message flow. Therefore, dictionaries that are currently associated with any policy rule cannot be deleted from the Filters repository See the Usage column on the Filters tab. To safely delete dictionaries, browse all policy rules using the dictionaries by navigating to the specific policy rules via the link on the Usage column, and unlink the dictionaries from the appropriate policy rules. Only then can the dictionaries be deleted from the Filters tab.
  • Audit dictionary actions. Any time a dictionary is added, deleted, or moved, a record of the action will be saved in the audit trail. This will ensure that any outcomes associated with adding, deleting, or moving a dictionary can be tracked to the root cause.
noteNote:
The Dictionary feature supports .txt and .csv files only. The maximum permissible file size for dictionaries is 2 MB and each file can support 9,000 characters. Additionally, dictionary files support only Basic syntax. For more information about the supported syntax, see Basic Syntax in Understanding Policy Rule Syntax.

How to import a dictionary

  1. From the Administration tab, click the Filters tab.
  2. In the Tasks pane, click Import Dictionary.
  3. In the Import Dictionary box, select Browse.
  4. Find and select the .csv or .txt file and then click Open.
  5. If desired, change the name of the dictionary file in the Dictionary name: field; otherwise, whatever name you gave the file when you saved it to your own files will be used in this dialog box and once the dictionary has been uploaded.
  6. Select the appropriate type of content that your dictionary contains, for example domain names or e-mail addresses, from the Dictionary contents menu.
  7. If desired, add any comments about the dictionary in the Comments field.
  8. Select Import.

How to replace a dictionary

  1. From the Administration tab, select the Filters tab.
  2. In the Tasks pane, select Import Dictionary.
  3. In the Import Dictionary box, click Browse.
  4. Find and select the .csv or .txt file and then click Open.
  5. Change the name of the dictionary file in the Dictionary name: field to match the file name of the dictionary you want to replace.
  6. Select the check box Replace Dictionary if exists.
  7. Select the appropriate type of content that your dictionary contains; for example, domain names or e-mail addresses from the Dictionary contents menu. This content type needs to match the content of the dictionary you want to replace.
  8. If desired, add any comments about the dictionary in the Comments field.
  9. Select Import.

How to add a dictionary to a rule

  1. Select the Policy Rules tab.
  2. Select the rule you want to apply the dictionary to by clicking the appropriate rule ID, or create a new rule.
  3. Expand the policy editor fields for the appropriate message section; for example Body, by selecting the down-arrow icon next to the section title.
  4. Select your uploaded dictionary from the Dictionary combo box.
    noteNote:
    You can either have a match expression in the text box, or select Dictionary. If you select Dictionary, the text box will be de-activated, and any match expressions entered in this text box will be deleted upon saving the policy rule.
    noteNote:
    If you try to add a dictionary that contains content that is not appropriate for the policy rule match field that you have selected, the dictionary will not appear as an option when you try to add it to the rule. For example, if you try to add a dictionary that contains IP addresses to a policy rule for the Sender e-mail addresses match field, the IP addresses dictionary will not be available for this policy rule match field. The dictionary must contain only content that is appropriate for the match field you have selected (in this example, e-mail addresses rather than IP addresses).
  5. Add additional settings to the policy rule and click Save.

How to delete a dictionary

  1. Select the Filters tab.
  2. Select the dictionary you want to delete by clicking the check box next to the name of the appropriate dictionary.
    importantImportant:
    If the dictionary you wish to delete is currently in use by any policy rules, browse all policy rules associated with this dictionary by navigating to the specific policy rule by selecting Usage within the Filters tab, and unlink the dictionary from these policy rules. Then you can return to the Filters tab and delete the dictionary.
  3. Select the appropriate dictionary and click Delete.

How to audit a dictionary-related action

  1. Select the Tools tab.
  2. Select the Audit Trail tab.
  3. Browse the Audit Trail for the PatternFiles events. Information related to the creation, replacement, and deletion of dictionaries is recorded here.
Advertisements