Rules Sample ?

[Phibee Network Operation Center <no...@phibee.net>]

Hi

anyone have a small rules sample for this:

header FROM_TEST_NOC_1      To =~ /\@mydomain\.org/
header FROM_TEST_NOC_2      From =~ /\test@sender\.org/
header FROM_TEST_NOC_3      Reply-To =~ /\test@sender\.org/

and if in one Email, we have :
    FROM_TEST_NOC_1 + (FROM_TEST_NOC_2 or/and FROM_TEST_NOC_3)
score -1.1

thanks for your help
jerome

Re: Rules Sample ?

[Matt Kettler <mk...@verizon.net>]

Phibee Network Operation Center wrote:
> Hi
>
> anyone have a small rules sample for this:
>
> header FROM_TEST_NOC_1      To =~ /\@mydomain\.org/
> header FROM_TEST_NOC_2      From =~ /\test@sender\.org/
> header FROM_TEST_NOC_3      Reply-To =~ /\test@sender\.org/
>
> and if in one Email, we have :
>    FROM_TEST_NOC_1 + (FROM_TEST_NOC_2 or/and FROM_TEST_NOC_3)
> score -1.1 

meta FROM_TEST_NOC   (FROM_TEST_NOC_1 && (FROM_TEST_NOC_2 ||
FROM_TEST_NOC_3))
score FROM_TEST_NOC -1.1

Note: you will probably want to rename the FROM_TEST_NOC_1 and company
to __FROM_TEST_NOC_1, unless you wish to assign scores to them. Adding a
double underscore to the start of a rulename makes it run, but it runs
"silently" without a score, and without showing up in the hits.