内容过滤模块设置代码

2024年12月12日

ID 287368

如果在事件日志设置中启用了审核事件和修改设置的日志记录,则当“内容过滤”模块的设置被编辑时,有关更改的详细信息会记录在审核日志事件中。

下表显示了“内容过滤”模块的设置在审核日志记录中如何被编码。

审核事件记录中“内容过滤 → 主要”部分的设置代码

“内容过滤 → 主要”设置

审核事件记录中的代码

示例

左侧窗格中的“内容过滤”开关

scanSettings.cfScanSettings.
engineSettings.enableScan

可能的值:

  • true,如果切换开关为
  • false,如果切换开关为

创建的规则:

scanSettings.cfScanSettings.engineSettings.
enableScan[][false]

scanSettings.cfScanSettings.actionSelectionPolicy[]
[HighestPriorityExpressionAction]

修改的规则:

scanSettings.cfScanSettings.engineSettings.
enableScan[false][true]

scanSettings.cfScanSettings.actionSelectionPolicy
[HighestPriorityExpressionAction][StrictestAction]

删除的规则:

scanSettings.cfScanSettings.engineSettings.enableScan
[true][]

scanSettings.cfScanSettings.actionSelectionPolicy
[StrictestAction][]

当找到匹配时

scanSettings.cfScanSettings.
actionSelectionPolicy

可能的值:

  • HighestPriorityExpressionAction,如果选择了“应用优先级最高的表达式的操作,忽略其他表达式”操作。
  • StrictestAction,如果选择了“应用所有匹配表达式的最严格操作”操作。

审核事件记录中“内容过滤 → 扫描错误时的操作”部分的设置代码

“内容过滤 → 扫描错误时的操作”设置

审核事件记录中的代码

示例

扫描错误时的操作”选项卡,“如果发生内容过滤错误”设置组

操作

scanSettings.cfScanSettings.
errorActions.action

可能的值:

  • Skip,如果选择了“跳过”操作。
  • Reject,如果选择了“拒绝”操作。
  • DeleteMessage,如果选择了“删除邮件”操作。

创建的规则:

scanSettings.cfScanSettings.errorActions.action[][Skip]

scanSettings.cfScanSettings.errorActions.backup[][false]

scanSettings.cfScanSettings.errorActions.mark[][%5BERROR%5D]

修改的规则:

scanSettings.cfScanSettings.errorActions.action[Skip][Reject]

scanSettings.cfScanSettings.errorActions.backup[false][true]

scanSettings.cfScanSettings.errorActions.mark[%5BERROR%5D]
[%5BCF ERROR%5D]

删除的规则:

scanSettings.cfScanSettings.errorActions.action[Reject][]

scanSettings.cfScanSettings.errorActions.backup[true][]

scanSettings.cfScanSettings.errorActions.mark[%5BCF ERROR%5D][]

将原始邮件放入备份

scanSettings.cfScanSettings.
errorActions.backup

可能的值:

  • true,如果切换开关为
  • false,如果切换开关为

要添加到邮件主题的文本

scanSettings.cfScanSettings.
errorActions.mark

扫描错误时的操作”选项卡,“附加设置”设置组

删除标头 – 文本

scanSettings.cfScanSettings.
errorActions.headersToChange.
headersToDelete.textList

对于“文本”选项卡上的更改:

创建的规则:

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToDelete.textList.Added[X-MS-Exchange-Abc X-MS-Exchange-Def]

修改的规则:

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToDelete.textList.Added[X-MS-Exchange-Ghi X-MS-Exchange-Xyz]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToDelete.textList.Removed[X-MS-Exchange-Def]

删除的规则:

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToDelete.textList.Removed[X-MS-Exchange-Abc X-MS-Exchange-Ghi X-MS-Exchange-Xyz]

删除标头 – 通配符

scanSettings.cfScanSettings.
errorActions.headersToChange.
headersToDelete.wildcardList

删除标头 – 正则表达式

scanSettings.cfScanSettings.
errorActions.headersToChange.
headersToDelete.regexList

修改标头

scanSettings.cfScanSettings.
errorActions.headersToChange.
headersToModify

列表中的值表示为记录对:一个表示标头名称,另一个表示值。

如果添加或删除了标头,则此类事件由两个记录表示:

1. 添加或删除标头的记录,形式如下:

scanSettings.cfScanSettings.
errorActions.headersToChange.
headersToModify{N}.<header name>

2. 添加或删除标头的值的记录,其形式如下:

scanSettings.cfScanSettings.
errorActions.headersToChange.
headersToModify{N}.<header value>

如果只更改标头,则该对的修改将由以下形式的单个记录表示:

scanSettings.cfScanSettings.
errorActions.headersToChange.
headersToModify{N}.<header name>

如果只更改标头的值,则该对的修改将由以下形式的单个记录表示:

scanSettings.cfScanSettings.
errorActions.headersToChange.
headersToModify{N}.<header value>

其中 N 是该对在对列表中的序列号。

如果某行的序列号发生变化,则该对的修改将由以下形式的单个记录表示:

scanSettings.cfScanSettings.
errorActions.headersToChange.
headersToModify{N}.<serial number>

创建的规则:

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{1}.name[][X-MS-Exchange-Abc]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{1}.value[][123]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{2}.name[][X-MS-Exchange-Def]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{2}.value[][456]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{3}.name[][X-MS-Exchange-Ghi]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{3}.value[][789]

修改的规则:

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{1}.name[X-MS-Exchange-Abc][]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{1}.value[123][]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{2}.value[456][444]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{2}.index[2][1]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{3}.name[X-MS-Exchange-Ghi][X-PT-Ghi]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{3}.index[3][2]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{3}.name[][X-MS-Exchange-Xyz]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{3}.value[][111]

删除的规则:

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{1}.name[X-MS-Exchange-Def][]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{1}.value[444][]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{2}.name[X-PT-Ghi][]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{2}.value[789][]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{3}.name[X-MS-Exchange-Def][]

scanSettings.cfScanSettings.errorActions.headersToChange.
headersToModify{3}.value[111][]

您觉得这篇文章有帮助吗?
我们可以做什么更好?
感谢您的反馈!你正在帮助我们进步。
感谢您的反馈!你正在帮助我们进步。