Technical Tip: Detect emails with an empty body

[nagarajs_FTNT]

Description

This article describes how to use a DLP profile to detect emails with an empty body.

Scope

FortiMail v6.2.5 and above, v6.4.1 and above, v7.and above.

Solution

1. Go to Data Loss Prevention -> Rule & Profile -> Rule. If the DLP is not enabled, check: Preventing Data Loss in FortiMail
2. Create a new message scan rule.
3. Create a new condition as below.

4. Go to Data Loss Prevention -> Rule & Profile -> Profile.
5. Create a new DLP profile.
6. Create a new DLP content scan setting as below and select the scan rule created earlier.
7. It is possible to select the required action profile for the scan rule.

8. Apply the new DLP profile to the IP policy:

Or a Recipient policy:

Result:

The mail with an empty body is detected by the DLP profile, and the 'Quarantine' action is applied.