Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Jeff_Roback
Contributor

Content Dictionary with Regular Expressions not working for Header Only?

Has anyone else had issues with content dictionary using regular expression detecting phases from the body of the message instead of just the header?     I have a regular expression written to look for forged from: headers in the messages, and it seems to be working correctly, but it's also flagging on all messages that generate bouncebacks from remote servers.   So my theory is that the regex is being run against the body of the message as well.   Or perhaps the fortimail is considering the body of a bounceback message to also be the header.

 

I have a case open with support but was curious if anyone else has run into this.

Jeff Roback

Jeff Roback
5 REPLIES 5
Jjchen_FTNT
Staff
Staff

Hello, did you choose "Search header" only for the regex entry? You can post ticket number so that I can help take a look.

Jeff_Roback

Hi there,  yes, I have Header true, Body false for the dictionary entry.     For the Content profile, I don't have scan enabled for PDF/MSOffice or Archive.   

 

My Ticket number  #4753208.  I have our full config uploaded there as well as sample emails that are triggering the dictionary match unexpectedly.

 

Thanks for having a look!

 

Jeff Roback

Jeff Roback
Jjchen_FTNT

Hi Jeff,

I checked your email sample, it's the email attachment in bounce email that triggers regex header search. The attachment is an email, so its header is checked.

Jeff_Roback

Thanks so much for taking a look at this!

 

Is there any way to have the Fortimail not look at the header portion of attached messages and consider those part of the message body?   While I can see that this is also a message header from the Fortimail's perspective, it seems like when we do header analysis we're focused on looking at the header that's describing the message currently being delivered, and not concerned with the content of the body or any part of the attachment.

 

Or I suppose to focus on the my original goal, do you think there's any way to run a regex to catch a forged "Header From" without having it get tripped up with attachments?   The two cases we've seen it give the false positive for are with bounce back messages, and also when someone on the outside sends a message to someone on the inside and attaches a copy of a message that someone on the inside had sent to them previously.    Both of these are message type that I need to allow through, but at the same time I really need to come up with a way to block messages with a forged "envelope from" header, since that's what gets displayed in outlook.

Jeff Roback

Jeff Roback
Jjchen_FTNT

FortiMail will check message/rfc822 content-type attachment which cannot be disabled. The best way to detect forged header-from is to use Impersonation Analysis feature, you can let TAC guide you through to configure the feature.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors