Thanks Paul – yeah that’s exactly what I was thinking about doing too (maybe…5-10 regex lines per rule) to narrow down the false-positive offender quicker…but I figured I’d ask the above question before I go and create 5 new test rules 🙂

Thanks for your help!

If you’ve thrown them all into a single rule you won’t be able to identity specific hits. What you can do is add them in small batches to a test rule. Once that test rule proves that it won’t create excessive false positives, move those values into a rule that is actively enforced, and test another small batch in the test rule. If you wanted to speed things up you could run multiple test rules at the same time. If a test rule is causing false positives you can just break it down into individual values to test further.

Unfortunately, I am a regex n00b so editing this list is a bit daunting to me if I don’t know which lines are the ones that flagged an email…especially when the message body is fairly extensive. I tried using a site like https://regexr.com/ or https://regex101.com/ to paste in the email body to be parsed by the regex strings above but didn’t have much success.

Got any shortcuts from new blood like myself, or is learning Regex the only real thing one can do?

Good question. No, it will bypass content filtering but not malware filtering. Malware filtering is mandatory.