Skip to main content

LevelBlue Named Official Cybersecurity Advisor of the PGA of America. Learn more

LevelBlue Named Official Cybersecurity Advisor of the PGA of America. Learn more

Services
Cyber Advisory
Managed Cloud Security
Data Security
Managed Detection & Response
Email Security
Managed Network Infrastructure Security
Exposure Management
Security Operations Platforms
Incident Readiness & Response
SpiderLabs Threat Intelligence
Solutions
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Operational Technology
End-to-end OT security
Microsoft
Unlock the full power of Microsoft Security
Securing the IoT Landscape
Test, monitor and secure network objects
Why LevelBlue
About Us
Awards and Accolades
LevelBlue SpiderLabs
PGA of America Partnership
Secure What's Next
LevelBlue Security Operations Platforms
Security Colony
Partners
Microsoft
Unlock the full power of Microsoft Security
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Loading...
Loading...

HOWTO: Using the Prepend rule action on messages with no subject

Expand / Collapse


This article applies to:

  • MailMarshal SMTP
  • Rule action "Prepend text to message subject"

Question:

  • Want to add text such as "[External]" to all message subjects
  • How do I add warning text to the subject when the message has no Subject: header?

Background:

Many organizations use the MailMarshal "Prepend to subject" rule action on all incoming messages to tag messages as external. 

  • Current default rules for new installations include this rule in the "Business Email Compromise" policy.

If the message does not have a "Subject:" header the prepend action does not work.

Procedure:

To resolve this issue, you can add the missing header. This action can be applied in the same rule with the Prepend action.

  1. Edit the rule, and select the action "Rewrite message headers using expressions"
  2. Click to add the expressions.
  3. Add an expression named "insert subject"
  4. On the General tab, select the following:
    • field parsing method: Entire line
    • header fields: Subject
  5. On the Expressions tab, enter the following:
    • Field substitute: Insert if missing
    • Text:  [No subject]
    • NOTE: when entering the text, there must be a space before the [   (the first character in any “insert if missing” text must be a space)
If this action is added to the warning rule that is present by default in new installations, the rule will appear as follows:
When a message arrives,
And the message is incoming
Then rewrite message headers using 'insert subject'
  And prepend [EXTERNAL] to message subject
  And continue processing

To contact LevelBlue about this article or to request support:


Rate this Article:
     

Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster
.