On 12/6/2013 3:23 PM, Marcio Humpris wrote:
Bowie Bailey <Bowie_Bailey <at> BUC.com> writes:
how can I adjust it?
First thought would be:
rawbody __RB_2_WDS /^(?:\s*\S+){0,2}\s*$/
Untested... Should match empty message, message with only whitespace,
or message with one or two words.
Thank you...
But how to make it catch just an email with ONLY 2 words in BODY? Not match
empty message?
If you don't want it to match an empty message, just change {0,2} to {1,2}.
Regexp translates to:
^ Beginning of string
(?: Start group
\s* Zero or more whitespace characters
\S+ One or more non-whitespace characters
) End group
{1,2} One to two matches of the preceding group
\s* Zero more more whitespace characters
$ End of string
As Amir mentioned, you should read up on Perl regular expressions if you
want to create SA rules.
--
Bowie
