Filter Policies – mxHero Help Center

A Filter Policy is a reusable yes/no test built from variables. Add it to a rule to run the rule only for emails that pass the test, for example only emails that mention an invoice, or never for senders on an exclusion list. Added to the rule's attachment filters (the Content Filter Policy), it decides attachment by attachment which files the rule processes. This page explains how to create a Filter Policy and the two places you can use it.

Before you begin

Create the variables the policy will test. See Custom Variables. The nine default variables (for example Common threat vector Extension) can be used directly.
Read how a rule decides whether to run. See Filters and Exclusions.

How a Filter Policy decides

A policy has one or more conditions. Each condition picks variables and a match mode:

Match mode	The condition is true when
All match	every chosen variable matches
At least one match	at least one chosen variable matches
No match	none of the chosen variables matches

Conditions are alternatives: the policy passes as soon as one condition is true. If no condition is true, it fails.

A variable matches when its condition is met. A variable that only returns its default value doesn't match.

Create a Filter Policy

Open Auto Filling › Filter Policies and click Create.
Enter a Name (required, up to 100 characters) and, optionally, a Description (up to 500).
In #1 Policy Condition, open When these variables: and choose one or more variables. The list shows Default Variable and User Variable entries with their descriptions.
Choose All match, At least one match or No match.
To add an alternative, click Add Condition. To remove one, click its trash icon.
Click Save Policy.

A Filter Policy has no destination and no default condition. It only passes or fails.

Use it as a rule filter (Target Filters)

As a target filter, the policy decides whether the rule runs for the email at all.

In the rule wizard, confirm 2. Target.
Click Add Filters below the Target step. The Target Filters panel opens. (For User Mailboxes it opens automatically.)
Turn on Use filter policy ("Apply a filter policy that executes the rule only when its conditions are met.") and choose the policy.
Click Confirm.

If the policy fails, the rule is skipped for that email. Available for Email Flow, User Mailboxes and Forwarding Address targets.

Use it as a Content Filter Policy (attachment filters)

In the action's attachment filters, the policy is tested for each attachment. Only attachments that pass are processed; the others are left as they are. Use it with variables about the attachment, such as Attachment Extension, Attachments Text or Microsoft Sensitivity Label.

In the rule wizard, click Add Filters below 1. Action. The panel is called Action Filters or Attachments Filter, depending on the action and target.
Turn on Use filter policy ("Adds a filter policy that saves the attachment only when its conditions are met.") and choose the policy.
Click Confirm.

The policy works together with the other attachment filters in the panel (size, extension, name, type, inline images). An attachment must pass all of them.

Note: For Temporary Hold, Request Approval and Block Attachments, the attachment filter decides whether the rule runs: the email is held, sent for approval or blocked only if at least one attachment passes. For Temporary Hold and Request Approval, add it with Add attachment filter.

Where filters run in a rule

For Email Flow rules, mxHERO checks in this order:

Target Filters › Use filter policy. Fails: the rule is skipped.
Shortcodes, and whether the message is TNEF, for actions that check them.
The sender and recipient selection in 2. Target.
Action Filters / Attachments Filter, including the Content Filter Policy for each attachment.
Sender/Recipient (From/To) Exclusions.
The action runs.

Examples

Goal	Policy	Use as
Run a Copy Emails rule only for invoices	Condition: variable `IsInvoice`, All match	Target filter
Never process mail from addresses on an exclusion list	Condition: variable `ExcludedRecipients` (looks the address up in a dataset), No match	Target filter
Protect only office documents and PDFs	Condition: Common Office Attachment Extension, All match	Content Filter Policy
Hold email for review when an attachment is labeled Confidential	Condition: Microsoft Confidential Sensitivity Label, All match	Content Filter Policy on a Temporary Hold or Request Approval rule
Block risky file types	Condition: Common threat vector Extension, All match	Content Filter Policy on a Block Attachments rule
Act on either of two signals	Condition 1: `Protected Content`; Condition 2: `PII Test` (or one condition with both variables and At least one match)	Either

Edit Filter Policy with two variables and At least one match

Edit and delete

Open Auto Filling › Filter Policies and click Edit or Delete. Changes apply to all rules that use the policy. If a rule uses the policy, the dashboard lists it when you delete; change the rule first.

Note: On a User Mailboxes rule, the filter policy can't be changed after the rule is created.

Verify

Send a test email that should pass and one that shouldn't.
Check the storage (or the hold, approval or block) for each.
For an email the rule didn't process, open it in Email Flow Logs and check which rules ran.

Troubleshooting

Symptom	Cause	Fix
The rule never runs	The target filter policy always fails	Test each variable in the policy with a real email. Check that you didn't pick No match by mistake.
Some attachments aren't saved	The Content Filter Policy or another attachment filter excluded them	Check every filter in the panel; an attachment must pass all of them.
A message-level variable (like Subject) in a Content Filter Policy behaves oddly	The policy is tested once per attachment	Use message-level variables in a target filter; use attachment variables in the Content Filter Policy.
Save Policy shows an error	The name is empty, or a condition has no variable	Enter a name and at least one variable in each condition.
Hold or approval rule doesn't trigger for emails without attachments	An attachment filter limits the rule to emails with matching attachments	Remove the attachment filter, or use the policy as a target filter.