[Email DLP] Filter Settings - Create/Edit Rules – HENNGE One Help Center

Overview

This article explains how Email DLP Administrators can Create or Edit Rules. You can also check the flow of Attachments Handling, how to Configure it, and the details of each setting item.

Notes

The content of this article is based on the product specifications as of July 2026, and may be subject to change without notice.
Email DLP Administrator privileges are required to actually check the screen or change settings.
Please refer to the following article for how to Configure Administrator privileges.
[Email DLP] Configuring Administrator privileges
Please refer to the following article for how to access the admin screen.
[Email DLP] How to log in to the admin screen
Please Create the target Rule Group in advance.
[Email DLP] Filter Settings - Creating/Editing Rule Groups
Please refer to the following article for the flow of Attachments Handling.
[Email DLP] I want to know the flow and configuration method for handling attachments

Procedure

Procedure for Creating/Editing Individual Rules

In the left menu of the Email DLP admin screen, click [Filter Settings] - [Rule Groups].
Select the target Rule Group.
A list of Rules included in the selected Rule Group will be displayed.
Click one of the following depending on the operation you want to perform.
- To create a new rule: [+ Create new rule]
- To copy an existing rule: the copy button in the center
- To edit a rule: the edit button on the left
Enter each item, then click [+ Create] or [Apply].
For details on each item, please check Items (Rule configuration items).

Procedure for Bulk Creating/Editing Rules

Using a YAML or JSON file, you can Create Filters in bulk.

YAML File Example

version: 1
rule_groups:
- name: 社外宛てルール
  rules:
  - priority: 100
    name: すべてのファイルがパスワード保護されていた場合は 5 分保留
    action:
      type: suspend
      attribute:
        auto_release: true
        duration: 5m
    predicate: and
    predicates:
    - target: attachment
      predicate: all-password-protected-data
      pattern: ""
      count: 0
  - priority: 110
    name: ZIP が添付されていた場合は削除
    action:
      type: delete
      attribute: {}
      notifies:
      - type: notify_sender
    predicate: and
    predicates:
    - target: attachment
      predicate: filename-match
      pattern: \.zip$
      count: 1
  - priority: 120
    name: 5 分保留 + Secure Download
    action:
      type: suspend
      attribute:
        auto_release: true
        duration: 5m
      secure_transfer: true
    predicate: all

For information on creating data in YAML or JSON files, and for Integrate/Overwrite, please refer to the following pages.

About Creating Email DLP Import Data (Configuration File)
Difference Between "Overwrite" and "Integrate" Import Methods

Configure the created or edited Rule in the Filter.
If the target Rule has already been configured in the Filter, no action is required.
Email DLP Filter Settings - Creating/Editing Filters

Items (Rule Configuration Items)

Name		Description	Notes
Group Name		Rule Group Name	The Rule Group Name will be automatically entered. In this procedure, the Rule Group Name cannot be changed. To edit the Rule Group Name, please refer to the following article. Email DLP Filter Settings - Creating/Editing Rules
Rule Name		Any name	This content applies to the merge tag `((%RULE-NAME%))` that can be used in Notification (Filter). Please set the Rule Name within 256 characters.
Description		Description of the Rule	Enter any description. This field is not required. This content applies to the merge tag `((%RULE-DESCRIPTION%))` that can be used in Notification (Filter). Please set the Description within 1024 characters.
priority		priority of the Rule to be created	Rules are filtered in order from the smallest priority number. Once a Rule matches, filtering by subsequent Rules will not be executed. priority can be specified in the range from 1 to 99999.
Action		Action of the Rule	Select one of the following Actions. send: The email will be sent immediately without being suspended. Suspend: You can set a range from 1 Minutes to 999 Minutes, or set [Do not release the suspension automatically]. If set to [Do not release the suspension automatically] and 10 days pass without being suspended or discarded, it will be automatically deleted. If [Visible to people in From Address Group] is checked, other users who belong to the same Address group as the Sender can also perform operations (View, send, Discard). Request Approval: The sent email will be suspended until it is approved by an Approver preset in the Address group. If it is not approved within 10 days, it will be automatically deleted. For settings related to Request Approval, please refer to the following article. Request Approval Settings Discard: The sent email will be deleted on Email DLP.
Add BCC		Whether to Add a preset address to Bcc	Can be Configure in combination with send/Suspend/Request Approval. Up to 5 can be configured. When configuring multiple addresses, enter each address on a new line.
Attachments		Attachments Handling	Can be Configure in combination with send/Suspend/Request Approval. "Send via Secure Download (HSD)" and "Send via Secure Download for Box (HSDB)" are only displayed for customers who have these features enable. Select one of the following. Send via Secure Download (HSD): Attachments will be sent using the Secure Download feature. Send via Secure Download for Box (HSDB): Attachments will be sent using the Secure Download for Box feature. Send with ZIP encryption: Attachments will be sent with ZIP encryption. If "Send with ZIP encryption" is selected, the Filename after encryption and encoding method must be Configure in the Encryption Types definition. Create an Encryption Types definition Send unmodified: Attachments will be sent unmodified.
Test Mode		A verification mode in which Rules are not processed	For details about Test Mode, please refer to the following article. I want to verify a new rule in advance (how to use Test Mode)
Notification		Notify the Sender/Approvers that an Action (send/Suspend/Request Approval/Discard) has been applied	For how to create a Notification, please refer to the following article. Create a Notification (Filter)
Rule Conditions		Conditions for applying the Rule	Set the conditions under which the Action (send/Suspend/Request Approval/Discard) or Attachments Handling (ZIP encryption/Secure Download, etc.) configured in the previous steps will be applied. Select one of the following. Match all of the following conditions (AND): This Rule will be applied when all of the defined conditions are met. Match any of the following conditions (OR): This Rule will be applied when any one of the defined conditions is met. All (no conditions set): Select this to apply the Rule to all emails without setting any conditions.
Add	Target	Condition of the target to which the Rule applies	This is displayed when you select "Match all of the following conditions (AND)" or "Match any of the following conditions (OR)" in Rule Conditions and click [+ Add]. Select one of the following. To: This is the To header. Cc: This is the Cc header. Bcc: This is the Bcc header. The Bcc header can only be detected for emails addressed to Bcc. To/Cc: This is the To and Cc headers. If you select either "To (Recipients)", "Cc", or "To/Cc", a radio button will be displayed to select whether to target "email address" or "Domain Part". Subject: This is the Subject header. Optional Header: You can specify the header to be searched. A field for entering the header will be displayed, so please enter the target header, such as "Content-type". Envelope To: This is the Envelope To address. It is the address of `RCPT TO:` in SMTP communication. Envelope From: This is the Envelope From address. It is the address of `MAIL FROM:` in SMTP communication. Message Body(include attachment(s)): This targets the email body and Attachments. For information on the Search Field for attachments, please refer to the following article. Search targets for the filter rule "Message Body (include attachment(s))" condition Attachments: This targets only Attachments.
	Predicate	Rule Conditions	This is displayed when you select "Match all of the following conditions (AND)" or "Match any of the following conditions (OR)" in Rule Conditions and click [+ Add]. Select one of the following. The displayed content differs depending on the item selected in Target. exists: The Action is executed if some value exists in the specified target. does not exist: The Action is executed if no value exists in the specified target. matches regular expression: The Action is executed if the value of the specified target matches the regular expression a certain number of times or more. does not match regular expression: The Action is executed if the value of the specified target does not match the regular expression a certain number of times or more. exists in address group: The Action is executed if the email address contained in the specified target exists in a specific Address group. The specific Address group can be selected from "Pattern". This is displayed when you select either "To", "Cc", or "To/Cc" as the Target. If you select "Attachments" as the Target, the following options will be displayed. exists: The Action is executed if Attachments exist. does not exist: The Action is executed if no Attachments exist. with filename that matches regular expression: The Action is executed when the search string is found in the Attachment Name. Content-Type Specification: The Action is executed when the search string is found in the content type of the attachment. contains password-protected data: The Action is executed when one or more Attachments are password-protected. are all password-protected data: The Action is executed when all Attachments are password-protected. Email DLP can detect password protection for common business documents. The supported extensions are `{.zip / .docx / .doc / .xlsx / .xls / .pptx / .ppt / .pdf}` . Please verify in advance before using extensions other than those listed above. Depending on the application or environment used to create PDF and ZIP files, file format compatibility may be affected, and such files may not be detected as "password-protected."
	Pattern	The Pattern of the specified Predicate	This is displayed when "Match all of the following conditions (AND)" or "Match any of the following conditions (OR)" is selected for Rule Conditions and [+ Add] is clicked. Enter the search string in the Pattern field. If "matches regular expression" or "does not match regular expression" is set for "Predicate," you can search using the regular expressions defined on the following Help Center page. Reference: Setting Rule Conditions Using Regular Expressions Reference: Regular Expression Syntax (External Link) If "exists in address group" is selected for "Predicate," you can select an Address group. Please enter the search string.
	Count	The number of times the "Pattern" matches or does not match	This is displayed when "Match all of the following conditions (AND)" or "Match any of the following conditions (OR)" is selected for Rule Conditions and [+ Add] is clicked. The Action will be executed when the "Predicate" is met at least the specified number of times.
Message Size		The size of the email Message to which you want to apply the Rule	This Rule is applied when the total size of the Message (including Attachments) exceeds the specified size. You cannot specify the size of the Attachments alone as a condition. "Rule Conditions" and "Message Size" are combined conditions. The Action is executed only when both conditions are met.

Translation Disclaimer

This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.

In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.