Rule Parameters

Normally, these parameters do not need to be used directly, instead one can use the Actions configuration screen.

Parameters for email classification

Available parameters

BEC_decision_action
BEC_decision_email_screenshot
BEC_decision_keep_dana_assets
BEC_decision_notify_user
BEC_decision_subject_rewrite
EXTORTION_decision_action
EXTORTION_decision_email_screenshot
EXTORTION_decision_keep_dana_assets
EXTORTION_decision_notify_user
EXTORTION_decision_subject_rewrite
BLACKLIST_decision_action
BLACKLIST_decision_email_screenshot
BLACKLIST_decision_keep_dana_assets
BLACKLIST_decision_notify_user
BLACKLIST_decision_subject_rewrite
FILTER_high_confidence_decision_action
FILTER_high_confidence_decision_email_screenshot
FILTER_high_confidence_decision_keep_dana_assets
FILTER_high_confidence_decision_notify_user
FILTER_high_confidence_decision_subject_rewrite
FILTER_medium_confidence_decision_action
FILTER_medium_confidence_decision_email_screenshot
FILTER_medium_confidence_decision_keep_dana_assets
FILTER_medium_confidence_decision_notify_user
FILTER_medium_confidence_decision_subject_rewrite
FILTER_low_confidence_decision_action
FILTER_low_confidence_decision_email_screenshot
FILTER_low_confidence_decision_keep_dana_assets
FILTER_low_confidence_decision_notify_user
FILTER_low_confidence_decision_subject_rewrite
IMPERSONATION_high_confidence_decision_action
IMPERSONATION_high_confidence_decision_email_screenshot
IMPERSONATION_high_confidence_decision_keep_dana_assets
IMPERSONATION_high_confidence_decision_notify_user
IMPERSONATION_high_confidence_decision_subject_rewrite
IMPERSONATION_medium_confidence_decision_action
IMPERSONATION_medium_confidence_decision_email_screenshot
IMPERSONATION_medium_confidence_decision_keep_dana_assets
IMPERSONATION_medium_confidence_decision_notify_user
IMPERSONATION_medium_confidence_decision_subject_rewrite
IMPERSONATION_low_confidence_decision_action
IMPERSONATION_low_confidence_decision_email_screenshot
IMPERSONATION_low_confidence_decision_keep_dana_assets
IMPERSONATION_low_confidence_decision_notify_user
IMPERSONATION_low_confidence_decision_subject_rewrite
MALWARE_dynamic_decision_action
MALWARE_dynamic_decision_email_screenshot
MALWARE_dynamic_decision_keep_dana_assets
MALWARE_dynamic_decision_notify_user
MALWARE_dynamic_decision_subject_rewrite
MALWARE_static_decision_action
MALWARE_static_decision_email_screenshot
MALWARE_static_decision_keep_dana_assets
MALWARE_static_decision_notify_user
MALWARE_static_decision_subject_rewrite
PHISHING_high_confidence_decision_action
PHISHING_high_confidence_decision_email_screenshot
PHISHING_high_confidence_decision_keep_dana_assets
PHISHING_high_confidence_decision_notify_user
PHISHING_high_confidence_decision_subject_rewrite
PHISHING_medium_confidence_decision_action
PHISHING_medium_confidence_decision_email_screenshot
PHISHING_medium_confidence_decision_keep_dana_assets
PHISHING_medium_confidence_decision_notify_user
PHISHING_medium_confidence_decision_subject_rewrite
PHISHING_low_confidence_decision_action
PHISHING_low_confidence_decision_email_screenshot
PHISHING_low_confidence_decision_keep_dana_assets
PHISHING_low_confidence_decision_notify_user
PHISHING_low_confidence_decision_subject_rewrite
SPAM_high_confidence_decision_action
SPAM_high_confidence_decision_email_screenshot
SPAM_high_confidence_decision_keep_dana_assets
SPAM_high_confidence_decision_notify_user
SPAM_high_confidence_decision_subject_rewrite
SPAM_medium_confidence_decision_action
SPAM_medium_confidence_decision_email_screenshot
SPAM_medium_confidence_decision_keep_dana_assets
SPAM_medium_confidence_decision_notify_user
SPAM_medium_confidence_decision_subject_rewrite
SPAM_low_confidence_decision_action
SPAM_low_confidence_decision_email_screenshot
SPAM_low_confidence_decision_keep_dana_assets
SPAM_low_confidence_decision_notify_user
SPAM_low_confidence_decision_subject_rewrite
VIP_FRAUD_high_confidence_decision_action
VIP_FRAUD_high_confidence_decision_email_screenshot
VIP_FRAUD_high_confidence_decision_keep_dana_assets
VIP_FRAUD_high_confidence_decision_notify_user
VIP_FRAUD_high_confidence_decision_subject_rewrite
VIP_FRAUD_medium_confidence_decision_action
VIP_FRAUD_medium_confidence_decision_email_screenshot
VIP_FRAUD_medium_confidence_decision_keep_dana_assets
VIP_FRAUD_medium_confidence_decision_notify_user
VIP_FRAUD_medium_confidence_decision_subject_rewrite
VIP_FRAUD_low_confidence_decision_action
VIP_FRAUD_low_confidence_decision_email_screenshot
VIP_FRAUD_low_confidence_decision_keep_dana_assets
VIP_FRAUD_low_confidence_decision_notify_user
VIP_FRAUD_low_confidence_decision_subject_rewrite
INTERNAL_EXTORTION_decision_action
INTERNAL_EXTORTION_decision_email_screenshot
INTERNAL_EXTORTION_decision_keep_dana_assets
INTERNAL_EXTORTION_decision_notify_user
INTERNAL_EXTORTION_decision_subject_rewrite
INTERNAL_PHISHING_high_confidence_decision_action
INTERNAL_PHISHING_high_confidence_decision_email_screenshot
INTERNAL_PHISHING_high_confidence_decision_keep_dana_assets
INTERNAL_PHISHING_high_confidence_decision_notify_user
INTERNAL_PHISHING_high_confidence_decision_subject_rewrite
INTERNAL_PHISHING_medium_confidence_decision_action
INTERNAL_PHISHING_medium_confidence_decision_email_screenshot
INTERNAL_PHISHING_medium_confidence_decision_keep_dana_assets
INTERNAL_PHISHING_medium_confidence_decision_notify_user
INTERNAL_PHISHING_medium_confidence_decision_subject_rewrite
INTERNAL_PHISHING_low_confidence_decision_action
INTERNAL_PHISHING_low_confidence_decision_email_screenshot
INTERNAL_PHISHING_low_confidence_decision_keep_dana_assets
INTERNAL_PHISHING_low_confidence_decision_notify_user
INTERNAL_PHISHING_low_confidence_decision_subject_rewrite
WHITELIST_decision_action
SIMULATION_decision_action

Available suffixes to the parameters for inbound email defense:

General parameter suffix	Function	Values
`_action`	Decides what should happen with the email	`QUARANTINE`, `DROP`, `DELIVER` or `UNDECIDED` `UNDECIDED` will result in a `DELIVER` if no other rule specifies another action
`_email_screenshot`	Enables or disables email content preview as a static image	`true` or `false`
`_keep_dana_assets`	Enables or disables storing Sandbox screenshots	`true` or `false`
`_notfiy_user`	Sends the recipient a notification that an incoming email has been quarantined	`true` or `false`
`_subject_rewrite`	Prepends a specified text to the email when delivered. Usually used in conjunction with the `DELIVER` or `UNDECIDED` action	text string

Those rule parameters can be adjusted per verdict and confidence. For example, the following configuration activates quarantining for high-confidence phishing, but delivers medium-confidence phishing with a subject rewrite:

local.properties

# Quarantine high-confidence phishing emails
PHISHING_high_confidence_decision_action=QUARANTINE
# Do not send a quarantine notification
PHISHING_high_confidence_decision_notify_user=false
# Do not do a subject rewrite
PHISHING_high_confidence_decision_subject_rewrite=
 
# Deliver medium-phishing confidence emails (if no other verdict has another decision)
# Specifying DELIVER would force-deliver this email even if another verdict also applies
PHISHING_medium_confidence_decision_action=UNDECIDED
# Do not send a quarantine notification
PHISHING_medium_confidence_decision_notify_user=false
# Do a subject rewrite with [SPAM]
PHISHING_medium_confidence_decision_subject_rewrite=[SPAM]

Parameters for reported emails

Available parameters

REPORTED_enable_filter_decision_state
REPORTED_enable_receipt_acknowledgement_state
REPORTED_enable_receipt_acknowledgement_template
REPORTED_BEC_decision_action
REPORTED_BEC_decision_template
REPORTED_BENIGN_early_decision_action
REPORTED_BENIGN_early_decision_template
REPORTED_EXTORTION_decision_action
REPORTED_EXTORTION_decision_template
REPORTED_FILTER_high_confidence_decision_action
REPORTED_FILTER_high_confidence_decision_template
REPORTED_FILTER_medium_confidence_decision_action
REPORTED_FILTER_medium_confidence_decision_template
REPORTED_FILTER_low_confidence_decision_action
REPORTED_FILTER_low_confidence_decision_template
REPORTED_BLACKLIST_decision_action
REPORTED_BLACKLIST_decision_template
REPORTED_IMPERSONATION_high_confidence_decision_action
REPORTED_IMPERSONATION_high_confidence_decision_template
REPORTED_IMPERSONATION_medium_confidence_decision_action
REPORTED_IMPERSONATION_medium_confidence_decision_template
REPORTED_IMPERSONATION_low_confidence_decision_action
REPORTED_IMPERSONATION_low_confidence_decision_template
REPORTED_INTERNALLY_FORWARDED_decision_action
REPORTED_INTERNALLY_FORWARDED_decision_template
REPORTED_MALWARE_dynamic_decision_action
REPORTED_MALWARE_dynamic_decision_template
REPORTED_MALWARE_static_decision_action
REPORTED_MALWARE_static_decision_template
REPORTED_PHISHING_high_confidence_decision_action
REPORTED_PHISHING_high_confidence_decision_template
REPORTED_PHISHING_low_confidence_decision_action
REPORTED_PHISHING_low_confidence_decision_template
REPORTED_PHISHING_medium_confidence_decision_action
REPORTED_PHISHING_medium_confidence_decision_template
REPORTED_SIMULATION_decision_action
REPORTED_SIMULATION_decision_template
REPORTED_NOT_JUNK_decision_action
REPORTED_NOT_JUNK_decision_template
REPORTED_SPAM_high_confidence_decision_action
REPORTED_SPAM_high_confidence_decision_template
REPORTED_SPAM_low_confidence_decision_action
REPORTED_SPAM_low_confidence_decision_template
REPORTED_SPAM_medium_confidence_decision_action
REPORTED_SPAM_medium_confidence_decision_template
REPORTED_VIP_FRAUD_high_confidence_decision_action
REPORTED_VIP_FRAUD_high_confidence_decision_template
REPORTED_VIP_FRAUD_medium_confidence_decision_action
REPORTED_VIP_FRAUD_medium_confidence_decision_template
REPORTED_VIP_FRAUD_low_confidence_decision_action
REPORTED_VIP_FRAUD_low_confidence_decision_template
REPORTED_WHITELIST_decision_action
REPORTED_WHITELIST_decision_template

The parameters for the handling of reported emails allow you to specify when a case should be handled automatically and with which feedback email:

General parameter suffix	Function	Values
`_action`	Specifies whether the case should be kept open or automatically closed	`QUARANTINE` (keep case open), `DROP` (auto-handle case) and `UNDECIDED` `UNDECIDED` will result in `QUARANTINE` if no other rule specifies a different action
`_template`	Specifies which feedback template should be sent back to the reporter. If the case is auto-handled, this feedback template will be automatically sent. If the case is kept open, this feedback template will be pre-selected in the web interface, but not sent. If this parameter is left empty, no feedback template is sent. All available templates can be seen under `shared/email_templates`	Name of a template (for a list of all available templates, please refer to Email Notification Templates)

The following example shows how to auto-handle high-confidence phishing, but keep medium-confidence phishing cases open:

local.properties

# Auto-handle emails classified as high-confidence phishing
REPORTED_PHISHING_high_confidence_decision_action=DROP
# Send back the phishing template
REPORTED_PHISHING_high_confidence_decision_template=PHISHING

# Keep case open if the email is classified as medium-confidence phishing
REPORTED_PHISHING_medium_confidence_decision_action=UNDECIDED
# Preselect the phishing template, but don't send it
REPORTED_PHISHING_medium_confidence_decision_template=PHISHING

Benign emails must fulfill additional requirements in order to be auto-handled based on the benign verdict (i.e., with REPORTED_BENIGN_early_decision_action=DROP). This should ensure that no malicious email is accidentally auto-handled as benign. Therefore, reported emails may be marked as benign, but not auto-handled. The most important requirements for auto-handling benign emails are:

All links must have a local reputation above 0.
Email must be internal or the sender must have at least medium trust.
No suspicious files attached (e.g., no HTML files).
No high spam or risk score.
No cloud storage links.

Disable acknowledgment emails

Normally, acknowledgment emails are disabled via the Actions configuration screen. In special cases, you can configure the following in activeguard/core/rule_sets/90_local/params/local.properties:

# Disable acknowledgment emails. Set to ACTIVE to enable it again
REPORTED_enable_receipt_acknowledgement_state=DISABLED

The email template used for the acknowledgment email can be configured in the following way (ACKNOWLEDGE_RECEIPT is the default):

# Specify the template used for acknowledgment emails
REPORTED_enable_receipt_acknowledgement_template=ACKNOWLEDGE_RECEIPT

Multi-Tenancy

The local.properties file used throughout this page lives in 90_local and therefore applies to all tenants. To set a parameter for a single tenant only, use a tenant.properties file in that tenant’s rule set instead of local.properties. See Manage Tenant Rules for the setup. To switch a tenant to a completely different set of parameters, reference a different rule profile for that tenant.

​Parameters for email classification

​Parameters for reported emails

​Disable acknowledgment emails

​Multi-Tenancy

Parameters for email classification

Parameters for reported emails

Disable acknowledgment emails

Multi-Tenancy