Subject line filtering enables you to filter messages, based on the content of the subject line of the message. Subject line filtering is available with all scan jobs (transport, realtime, scheduled, and on-demand). Wildcard characters can be used to further refine your filters.

To create a subject line filter list

  1. In the Forefront Protection 2010 for Exchange Server Administrator Console, click Policy Management, and then under the Filters section, click Filter Lists.

  2. In the Filters – Filter Lists pane, click the Create button.

  3. In the Select Filter Type dialog box, select Subject line and then click Next.

  4. In the Filter Details dialog box, specify the filter list name and filter details:

    1. In the Filter list name box, type a name for the new list.

    2. In the Filter criteria box, type the subject line text to be included in the filter list, and then click Add. You can only add one subject line at a time, but you can add as many entries as you want. Repeat this step in order to include additional strings of subject line text.

      If you want to type a partial subject line, it is recommended that you use asterisk wildcard characters (*) at the beginning and end of the phrase in order to ensure proper detection. For more information about using wildcard characters to refine your subject line filters, see Using wildcard characters to refine filters.

      Note:
      You can edit items in a subject line filter list by double-clicking the item, editing the item, and then pressing ENTER. You can delete items from a subject line filter list by selecting the item and then clicking Remove. You can also import items into a subject line filter list (for more information, see Importing items into a filter list) and export items from a subject line filter list (for more information, see Exporting items from a filter list).
    3. Click Next.

  5. In the Target dialog box, configure how you want the filter list to be applied to the transport, realtime, scheduled, and on-demand scan jobs:

    1. To enable the filter list for use with the scan job, using the Enabled drop-down list, select Yes.

    2. Configure the action that FPE should take when a file filter is matched by using the Action drop-down list for each scan job.

      For the transport scan job, select Skip detect, Purge, Identify in subject line (the default), Identify in message header, or Identify in subject line and message header.

      For the realtime and scheduled scan jobs, select either Skip detect (the default) or Purge.

      For the on-demand scan job, Skip detect is the only option.

      For more information about these options, see Configuring the action when a filter is matched.

    3. To configure FPE to quarantine messages and attachments when the filter is matched, using the Quarantine files drop-down list, select Yes. Quarantining for filters is enabled by default. Enabling quarantining causes deleted attachments and purged messages to be stored, permitting you to recover them. However, worm-purged messages are not recoverable.

    4. To configure notifications when the filter is matched, using the Notifications drop-down list, you can select Never send notifications to prevent the sending of the Subject line filter matched notification, even if it is enabled. Otherwise, FPE uses the configured Subject line filter matched notification settings; Use notification settings is the default.

    5. Click Create.

      The filter list you just created appears on the Filters – Filter Lists pane.

  6. Click Save.

For more information about viewing and managing this filter list and others, see Viewing and managing filter lists.