Google Message Security for Google Apps Administration Guide - Manual (Page 234)

234 Message Security for Google Apps Administration Guide
Tip: Instead of looking for exact text, you can look for a unique text pattern in
the junk messages. You can then use this pattern to create a regular
expression. See “About Using Regular Expressions” on page 218.
2. Create a filter:
a. Specify a name that identifies the spam.
b. Set the rule location to Body and the filter type to contains.
c. Set the rule value to the unique text of the email. Or create a regular
expression to scan messages for a unique pattern of characters.
3. Set Copy to Quarantine to Recipient. This disposition sends any captured
messages to Junk Quarantines in your users’ Message Centers.
4. Save the filter to begin quarantining messages that contain the unique text or
pattern.
5. Tell your users to check their quarantines more frequently for any legitimate
messages that contain a match for the new content filter.
Content Manager Tips and Best Practices
Use Regular Expressions Whenever Possible
When you create a filter rule, you can choose among several filter types—that is,
how the filter looks for the content you enter. Typically, the most effective filter type
is matches regex, even for simple filters that look for only single words.
For example, you can use the matches regex option to find only the word hell
and not other words that contain the characters in the word hell , such as hello or
shell . If you were to select the contains filter type, the filter would catch message
with the words hello or shell .
For an example of a regex that matches a whole word, see “Match Whole Word
Only” on page 226.