Skip to main content

LevelBlue Named Official Cybersecurity Advisor of the PGA of America. Learn more

LevelBlue Named Official Cybersecurity Advisor of the PGA of America. Learn more

Services
Cyber Advisory
Managed Cloud Security
Data Security
Managed Detection & Response
Email Security
Managed Network Infrastructure Security
Exposure Management
Security Operations Platforms
Incident Readiness & Response
SpiderLabs Threat Intelligence
Solutions
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Operational Technology
End-to-end OT security
Microsoft
Unlock the full power of Microsoft Security
Securing the IoT Landscape
Test, monitor and secure network objects
Why LevelBlue
About Us
Awards and Accolades
LevelBlue SpiderLabs
PGA of America Partnership
Secure What's Next
LevelBlue Security Operations Platforms
Security Colony
Partners
Microsoft
Unlock the full power of Microsoft Security
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Loading...
Loading...

HOWTO: Logging detailed TextCensor results

Expand / Collapse


This article applies to:

  • MailMarshal (SEG)
  • Logging of TextCensor results in Engine text log

Question:

  • Can I log details of what TextCensor expressions triggered?

Procedure:

In current versions of MailMarshal, you can choose to log fewer or more details of TextCensor activity.

By default the log includes triggered expressions (up to 2048 characters total).

Example triggered expression logging

The following example shows additional logging of triggered expressions (the two lines beginning "Expression").

3448 15:10:57.111 TextCensor triggered: Script "Language - Foodie" Triggered in Body
Expression "( fed OR feeds ) AND NOT fed-up" triggered 1 time, score 1
Expression "( eat OR eating ) FOLLOWEDBY = 1 ( pie OR ham OR cake )" triggered 1 time, score 5
3448 15:10:57.111 Name=U1\B5100982f0000.000000000001.0001.mml Message level criterion TRUE

To log additional information:

  • In MailMarshal 10.0 and above, open the Management Console and navigate to Advanced Settings. Add a new value:
    • Name: Engine.LogTCTriggerCriteria
    • Type: Boolean
    • Value: True (selected)
  • In MailMarshal 8.X and below, open the Registry Editor on the Array Manager. Within the base registry key, navigate to \Default\Engine
    • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Engine
    • For information about the registry location for each version, see article Q10832.
    • Enter the value as a new DWORD value named LogTCTriggerCriteria with a value of 1.
  • Save your registry settings or configuration settings.
  • Commit the configuration changes and restart the MailMarshal Engine service on each node.

Warning: As always, take due care when editing the Registry. Make a backup before making changes.



To contact LevelBlue about this article or to request support:


Rate this Article:
     

Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster
.