Content Dictionary with Regular Expressions not working for Header Only?

[Jeff_Roback]

Has anyone else had issues with content dictionary using regular expression detecting phases from the body of the message instead of just the header?     I have a regular expression written to look for forged from: headers in the messages, and it seems to be working correctly, but it's also flagging on all messages that generate bouncebacks from remote servers.   So my theory is that the regex is being run against the body of the message as well.   Or perhaps the fortimail is considering the body of a bounceback message to also be the header.

I have a case open with support but was curious if anyone else has run into this.

[Jjchen_FTNT]

Hello, did you choose "Search header" only for the regex entry? You can post ticket number so that I can help take a look.

[Jeff_Roback]

Hi there,  yes, I have Header true, Body false for the dictionary entry.     For the Content profile, I don't have scan enabled for PDF/MSOffice or Archive.   

My Ticket number  #4753208.  I have our full config uploaded there as well as sample emails that are triggering the dictionary match unexpectedly.

Thanks for having a look!

[Jjchen_FTNT]

Hi Jeff,

I checked your email sample, it's the email attachment in bounce email that triggers regex header search. The attachment is an email, so its header is checked.

[Jeff_Roback]

Thanks so much for taking a look at this!

Is there any way to have the Fortimail not look at the header portion of attached messages and consider those part of the message body?   While I can see that this is also a message header from the Fortimail's perspective, it seems like when we do header analysis we're focused on looking at the header that's describing the message currently being delivered, and not concerned with the content of the body or any part of the attachment.

Or I suppose to focus on the my original goal, do you think there's any way to run a regex to catch a forged "Header From" without having it get tripped up with attachments?   The two cases we've seen it give the false positive for are with bounce back messages, and also when someone on the outside sends a message to someone on the inside and attaches a copy of a message that someone on the inside had sent to them previously.    Both of these are message type that I need to allow through, but at the same time I really need to come up with a way to block messages with a forged "envelope from" header, since that's what gets displayed in outlook.

[Jjchen_FTNT]

FortiMail will check message/rfc822 content-type attachment which cannot be disabled. The best way to detect forged header-from is to use Impersonation Analysis feature, you can let TAC guide you through to configure the feature.