molney at sourcefire
Jun 13, 2013, 6:48 AM
Post #2 of 2
(108 views)
Permalink
|
If you have the requirements of certain rules, you should probably use a traditional signature format like .ndb or .ldb. If you need to do regular expressions, look at writing bytecode signatures, these are slightly more involved, though.
Alain might have some additional commentary.
Matt
On Jun 13, 2013, at 7:49 AM, Kunal Soni <kunalsoni9 [at] gmail> wrote:
> Dear List,
> I am using qmail + Clamd + Spam assassin and qmailscanner for our mailing
> solution. We have some business requirement where we need to track and
> monitor certain words in email like resume, resignation. We want to block
> the emails with these words but have a copy of all those emails at
> postmaster for tracking.
>
> I have checked the DLP configuration in clamd.conf for Socail Security
> NUmber, is there any way we can use the DLP for regular expressions and
> have one copy of email to postmaster. Since we have been using the
> qmailscanner and notification of Antivirsus action email received on
> postmaster. Can we integrate the same with Qmailscanner.
>
> Need your help!
>
> Thanks in advance
>
> --
> Kunal Soni
> (9810019739)
> _______________________________________________
> Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
> http://www.clamav.net/support/ml
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml
|
