Phibee Network Operation Center wrote: > Hi > > anyone have a small rules sample for this: > > header FROM_TEST_NOC_1 To =~ /\...@mydomain\.org/ > header FROM_TEST_NOC_2 From =~ /\t...@sender\.org/ > header FROM_TEST_NOC_3 Reply-To =~ /\t...@sender\.org/ > > and if in one Email, we have : > FROM_TEST_NOC_1 + (FROM_TEST_NOC_2 or/and FROM_TEST_NOC_3) > score -1.1
meta FROM_TEST_NOC (FROM_TEST_NOC_1 && (FROM_TEST_NOC_2 || FROM_TEST_NOC_3)) score FROM_TEST_NOC -1.1 Note: you will probably want to rename the FROM_TEST_NOC_1 and company to __FROM_TEST_NOC_1, unless you wish to assign scores to them. Adding a double underscore to the start of a rulename makes it run, but it runs "silently" without a score, and without showing up in the hits.
