for Google Workspace / for Microsoft 365
This article will explain the correct procedures to configure the Email filtering rules and conditions in the Admin console.
This article consists of the following three parts.
1) Define the Address Groups
2) Define the Rule Groups
3) Define Filter
1) Define the Address Groups
In this step, there are the following 3 parts:
a) Create the Address Group
b) Add Email Address to the Address Group
c) Delete the Address Group
a) Create the Address Group
☆ 1 - Click on the "Account" - "Define Address Groups" from the left menu, and click on the "Create" button.
☆ 2 - Please enter a name for the "Group Name" and in the "Addresses" part, you can enter either Full Email Address, Domain Name, or a Sub Domain Name. Lastly, click on "Create".
※If you wish to synchronize Email Address Group from Google Workspace or Microsoft 365 to HENNGE Email DLP Address Groups, please follow the articles below to enable those options on Microsoft 365 and Google Workspace and then enter the corresponding Names in the "Group Name" field for those groups to be found on HENNGE Email DLP.
How to synchronize groups in Google Workspace to HENNGE Email DLP service?
How to synchronize groups in Microsoft 365 to HENNGE Email DLP service
b) Add Email Address to the Address Group
☆ 1 - For an already created Address Group, Email Address and Domain Name, Sub Domain could be added to those groups. Please choose the "Define Address Groups" under "Accounts" and click on the Gear icon next to the Address Group that is needed to be edited.
☆ 2 - Please enter the Email Address, the Domain Name, and the Sub Domain Name that is needed to be added to the Address Group and click on "Create" to complete.（If you decide to delete one of the items, please remove that line and click on "Create" to apply.）
c) Delete the Address Group
☆ 1 - If you wish to delete the Address Group, please go to "Account" - "Define Address Group", and please click on the "Trash" icon on the right of the Address Group.
☆ 2 - The confirmation message will be displayed, and click on "Delete".
*Note – If there are Filters or Encryption Policies that use the deleted Address Group, those Filters and Encryption Policies will be automatically deleted as well.
2) Define Rule Groups
In this step, there are the following 3 parts:
a) Create Rule Group
b) Create Rule
c) Other Settings
a) Create Rule Group
☆ 1 - Click on the "Filter" - "Define Rule Group" on the left and click on the "Create" button.
☆ 2 - Input a name for the "Group Name" and click on "Create".
b) Create Rule
☆ 1 - a) Click on the Gear icon to the right of the Rule Group to expand the options.
☆ 2 - Click on the "+" icon to the right to create rules for this rule group.
☆ 3 - Please enter the necessary information that is required for this rule.
1) Rule Name: Any desired name for this rule.
2) Priority: Please enter a number between 1 and 99,999. A lower number is preferred than a higher number.
3) Action: Select any of the following actions.
- Send: Emails that match the conditions of this rule will be sent directly.
- Suspend: Emails that match the conditions of this rule will be suspended for a predefined duration (or forever) before sent out.
- Request Approval: Emails that match the conditions of this rule will be required approval.
※For detail setup for this feature, please refer to the following article.
Setup instructions of Approval Feature - Discard: Emails that match the conditions of this rule will be deleted.
※For details on the "Test Mode", please refer to the following article.
How can I use "Run in Test Mode" function?
4) Additional Information: Below fields are available for actions as well.
- Additional Bcc recipients（If "Send" , "Suspend" or "Request Approval" actions are selected）: Bcc Recipients Email Addresses can be added here (Up to 5 maximum). Please enter a separate line for each additional Bcc recipient.
- Attachments Encryption（If "Send" , "Suspend" or "Request Approval" actions are selected）: Option to enable or disable attachment encryption.
※ If the "Attachments Encryption" option is checked, please make sure that you have the following article procedures performed.
[ver.2] Settings of automatic encryption for attached files - Suspension（If "Suspend" is selected）: This option allows the duration for the suspended Email to be defined. The default is 10 minutes.
- Do not release the suspension automatically: If this option is checked, the Email will not be sent unless the user clicks on the "Send" button from the User Page. （All Emails suspended for more than 10 days will be deleted）.
- Visible to people in From Address Group: If this option is checked, members within the same Address Group will be able to "Send", "Stop" or "Delete" the Emails that are suspended.
※For User operations on the suspended Emails, please refer to the following article.
(ver.2) HENNGE Email DLP User Console Guide
※For how to use the Team Mail feature, please refer to the following article.
[ver.2]Team Mail function (Email DLP)
5) Notification: If the "To Sender" option is checked, the Sender will be notified of the action of the Email.
※ If the "To Sender" option is checked, the system will follow the "1) Notification for Filter" setting to notify the sender, so please make sure the following procedures have been performed.
Settings for Notification Emails
6) Rule Conditions: Please select one of the following options.
- Match all of the following (AND): The Rule will apply if and only if all of the specified conditions are fulfilled.
- Match any of the following (OR): The Rule will apply if any one of the specified conditions is fulfilled.
- Match all messages: The Rule will apply to all Email messages.
6-1) Target: Please choose one of the following options.
- To(Recipient): Header To.
- Cc: Header Cc.
- Bcc: Header Bcc.
※ Only Email that has Bcc recipient will be filtered. - To/Cc: (Recipient/Cc): Both Header To or Header Cc.
※ Will match either "To(Recipient)", "Cc" or "To/Cc: (Recipient/Cc)", if this option is selected, you will be able to find "Email Address" or the "Domain Part". - Subject: Header Subject.
- Optional Header: This option will allow any Header to be Filtered in the Email. If this option is selected, there will be additional space allowing you to enter the desired search Header. You can input options such as "Content-type".
- Envelope-To: The RCPT TO: Address that is used in SMTP Delivery.
- Envelope-From: The MAIL FROM: Address that is used in SMTP Delivery.
- Message Body(include attachment(s)) : This will enable Email attachment body and/or attachment content to be filtered.
- Attachment: This option will allow the filtering of the Email attachment file(s).
6-2) Predicate: Please select from one of the following options.
- exists: This option will match if the targeted field will have any values at all.
- does not exist: This option will match if the targeted field will not have the value.
- matches regular expression: This option will match if the targeted field matches the regular expression defined with a specified amount of repetitions.
- does not match the regular expression: This option will match if the targeted field does NOT match the regular expression defined with a specified amount of times.
※The following condition will only be available if the target is either "To(Recipient)", "Cc", "To/Cc".
- exists in the address group: The action is implemented when the email address or domain part contained in the specified target exists in a particular address group. A specific address group can be selected from "Pattern".
※The following condition will only be available if the target is "attachment".
- exists: This option will match If there are attachment files present.
- does not exist: This option will match if there are no attachment files at all.
- with filename: This option will match if the filename of the attachment matches the keywords defined below.
- with Content-Type: This option will match if the file type of the attachment matches the content type defined below.
- contains password-protected data: This option will match if there is at least one attachment that password has been protected.
- are all password-protected data: This option will match if and only if all of the attachments are password protected.
※HENNGE One Email DLP service can detect if office files or PDF files have been encrypted with passwords. The available file types are specified below:
MS-Office Word / Excel / Power Point, PDF, ZIP
6-3) Pattern: Please enter the keywords that are needed to be filtered. If "matches with regular expression" or "does not match with regular expression" are selected in the condition. The regular expression uses the POSIX1003.2 standard. If the "exists in address group" option is selected in the condition, the Address Groups will be displayed here available for selection.
6-4) Count: The number of times/threshold that the "Pattern" matches or not matches.
7) Message Size (KB): Enter the maximum limit so that if the Email message has exceeded, this rule will be triggered. (This is not only the attachment size but will be the size if all of the entire message)
※ If both "Rule Condition" and "Message Size" are specified, the rule will be applied if both conditions are met.
☆ 4 - If there is no problem with the setting of the rule, please click on the "Add" button at the bottom right of the window.
c) Other Settings
If there are Rule Groups already created and needed to be modified, please click on the Pencil icon next to the Rule Group that is needed to be edited.
If there are Rule Groups already created and needed to be deleted, please click on the Trash icon next to the Rule Group that is needed to be deleted.
*Caution – For Rule Groups that are deleted, if there are Filters that use the deleted Rule Group, those Filter will be deleted as well.
In order to edit a Rule within a Rule Group, please click on the Gear icon next to the Rule that is needed to be edited.
In order to delete a Rule within a Rule Group, please click on the Trash icon next to the Rule that is needed to be deleted.
3) Define Filters
In this step, there are 2 following parts:
a) Filter Settings
b) Other Settings
a) Filter Settings
☆ 1 - Click on the "Define Filters" under the "Filter" options and click on the "Create" button.
☆ 2 - Please set the following values in the "Create Filter" interface.
1) Priority: Please enter a number between 1 and 99,999. A lower number is preferred than a higher number.
2) Sender: This will match the Envelope-From Address, not the Header FROM. If "All" is selected, then the selected Rule Group will apply to all of the Senders.
3) Recipient: This will match the Envelope-To Address, not the Header To/Cc. If "All" is selected, then the selected Rule Group will apply to all of the Recipients.
4) Rule Group: Please select the desired Rule Group that will be applied.
b) Other Settings
☆ - If there are existing Filters that you wish to delete or modify, please enter the "Define Filter" page and click on the Gear icon next to the Filter that is needed to be edited. Please click on the Trash icon next to the Filter that is needed to be deleted.
