Technical Tip: Detect emails with an empty subject

[alya]

Description	This article describes how to use a dictionary profile to detect emails with an empty subject.
Scope	All FortiMail versions.
Solution	Go to Profile -> Dictionary. Create a new dictionary with the following regex expressions: ^Subject: $ It is necessary to enable: Search header.      3. Go to Profile -> Content and edit the Content Policy in use -> Expand Content Monitor and Filtering menu -> New. Result: Note: To avoid false positive detections, it is necessary to add the below: [EHeAdEr]   When using the Dictionary pattern, from\:.*\@customerdomain\.com.* and 'search header’, this will also check the headers of the original mail and the headers of other attached mails. In a dictionary scan, the headers of each MIME part are also considered as email headers. It is necessary to include '[EHeAdEr]' in the pattern to search only the original email header (actual mail). For example, [EHeAdEr] From\:.*\@customerdomain\.com.*. Note: The above RegEx uses a specialized match condition [EHeAdEr] that is unique to FortiMail and should be removed when testing pattern(s) with RegEx testing tools like www.regex101.com.