On 6/27/11 1:53 AM, "spixx_" <[email protected]> wrote:
>
> Thank you! This what was I was looking for!
>
> rawbody
Not certain why you are using rawbody. I might suggest you use subtests and
tflags multiple:
E.g:
body __GREEN_LIAISON1
/\b(?:proprietary|information|technology|renewables|alternative)\b/i
describe __GREEN_LIAISON1 Remove the emails with green tech spies
tflags __GREEN_LIAISON1 multiple
body __GREEN_LIAISON2
/\b(?:Positive|relationship|international|institutions)\b/i
describe __GREEN_LIAISON2 Remove the emails with green tech spies
tflags __GREEN_LIAISON2 multiple
header __GREEN_LIAISON3 Subject =~
/\b(?:Green|renewables|technology|liaison)\b/i
describe __GREEN_LIAISON3 Checking the header for more of the same
tflags __GREEN_LIAISON3 multiple
meta GREEN_LIAISON __GREEN_LIAISON1 > 2 && __GREEN_LIAISON2 > 2 &&
__GREEN_LIAISON3 > 1
describe GREEN_LIAISON Contains a lot of words found in green tech scams
> Not sure but I have to say that there is room for a good Howto on this
> topic. I will try and push myself to learn more and then try and make one
> for us dummies :)
A howto on writing rules? Or on perl regular expressions in general? If
you just want to understand perl regular expressions, there is no better
place to start than perldoc perlretut
--
Daniel J McDonald, CCIE # 2495, CISSP # 78281
