Creating a dictionary

To create a dictionary:

1. In the application web interface window, select the Rules section.
2. Click Dictionaries.
3. In the Dictionaries window, click Create.

   This opens the dictionary creation window.

4. In the Name field, enter a name for the dictionary. The name must be unique among the names of dictionaries (case-insensitive).

   This name is displayed in conditions in which the dictionary is used.

5. In the Description field, enter a description of the dictionary. The maximum length is 512 characters.
6. In the Dictionary contents list, select one of the following options:
   • Strings

     This type of dictionary contains a list of text string values, masks, and regular expressions.

   • File types

     This type of dictionary contains a list of file types.

7. If at the previous step, you selected the Strings option, under Search strings, specify a list of string values.

   You can specify values in the following ways:

   • Text

     To add some text, click Add, enter your text, then click or press ENTER. If necessary, repeat this step to add more strings.

     To paste text from the clipboard, click Import, type or paste text strings separated by semicolons or new lines, then click Import.

     If you want to edit a previously text string, click it in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

     If you want to remove a string from the list, point to the header in the list and click the icon. To clear the list, click Delete all.

     We do not recommend entering a string longer than 1000 characters.

     You can copy all text strings in the list. To do so, click Copy all.

     If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

   • Wildcard

     To add a search mask, click Add, enter your text, then click or press ENTER. If necessary, repeat this step to add more masks.

     To paste masks from the clipboard, click Import, type or paste search masks separated by semicolons or new lines, then click Import.

     If you want to edit a previously added mask, click the mask in the text box, make the necessary changes in edit mode, and click . If necessary, use search.

     If you want to remove a mask from the list, point to the mask in the list and click the icon. To clear the list, click Delete all.

     We do not recommend entering a mask longer than 1000 characters.

     You can copy all masks added to the list. To do so, click Copy all.

     If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

   • Regexp

     To add a regular expression, click Add, enter your regular expression, then click or press ENTER.

     Regular expressions of the PCRE format are supported. The search is performed in multi-line mode.

     Examples

     When searching in the body of the message using a regular expression of the ^test_pattern$ form, the condition is triggered for messages whose body consists of only the test_pattern string (no leading or trailing spaces), as well as for messages whose body contains at least one string consisting only of test_pattern (no leading or trailing spaces).

     If the condition must be triggered only for messages whose entire body consists of only the test_pattern string (without leading or trailing spaces), use the \Atest_pattern\z regular expression.

     You do not need to prefix the string with "re:".

     If necessary, repeat this step to add more regular expressions.

     To paste regular expressions from the clipboard, click Import, type or paste regular expressions separated by semicolons or new lines, then click Import.

     If you want to edit a previously added regular expression, click the regular expression in the text box, make the necessary changes in edit mode and click . If necessary, use search.

     If you want to remove a regular expression from the list, point to the regular expression in the list and click the icon. To clear the list, click Delete all.

     We do not recommend entering a regular expression longer than 1000 characters.

     You can copy all regular expressions in the list. To do so, click Copy all.

     If not all items are displayed in the area, you can select the number of items you want to display in the drop-down list in the lower part of the area.

8. The dictionary uses strings from all filled-in tabs.
9. If at the previous step, you selected the File types option, under Search strings on the tab All, select check boxes next to the relevant attachment types.
   • Archives: 7Z (including volumes with 7Z* extensions), ACR, ARJ, BZ, BZ2, TBZ, TBZ2, CAB, DMG, SMI, IMG, GZ, TGZ, ISO, JAR, RAR, TAR, XAR, ZIP
   • Databases: ACCDB, ACCDE, ACCDP, ACCDR, ACCDC, MDB, MDT.
   • Executable files: APK, SCPT, APPLESCRIPT, BAT, CMD, DEB, DEX, ODEX, ELF, CLASS, JS, O, DYLIB, MSI, PYC, PYO, RPM, SH, PL, VBS, EXE, DLL, OCX, SCR, LNK.
   • Image files:
     • Animated files: SWF
     • Bitmap images: BMP, GIF, JPG, JPE, JPEG, JFIF, PNG, APNG, TIF, TIFF
     • Vector graphics: CDR, EMF, WMF, EPS, PSD
   • Multimedia files:
     • Audio files: AAC, M4A, AC3, APE, CDA, FLAC, MID, MIDI, MKA, MP3, OGG, RM, RA, RAVB, WAV, WMA
     • Video files: 3GP, 3G2, 3GP2, 3P2, ASF, WMV, AVI, BIK, F4V, FLV, MKV, MOV, QT, DIVX, MP4, RM, RMVB, RTMP, VOB, DAT, MPG, MPEG
   • Document files:
     • Documents: DOC, DOCM, DOCX, DOT, DOTM, DOTX, ODT, PDF, RTF, SXW, XPS
     • Presentations: POTM, POTX, PPSM, PPSX, PPT, POT, PPS, PPTM, SLDM, PPTX, SLDX, ODP
     • Specialized files: PUB, MSG, OFT, ONE, ONEPKG, VDX, VSX, VTX, VSD, VSS, VST, XSN
     • Spreadsheets: XLAM, XLS, XLT, XLSB, XLSM, XLSX, XLTM, XLTX, ODS
   • Miscellaneous: CAT, CSV, HTML, HTM, TXT, CHM, REG
   • Other file types. These include unrecognized file types and file types that do not match any of the listed types.

   You can view the list of selected file types on the Selected tab.

10. Click Save.

The dictionary is created.