Hi,
This is a follow up to: https://www-secure.symantec.com/connect/forums/ev-custom-filters-and-x-headers
I have this working now and wanted to share.
Big kudos to zubkoff.s who was kind enough to answer my PMs and point me in the right direction.
Assume you have a general idea around how filtering works, required registry keys, etc. Good article here: https://www-secure.symantec.com/connect/articles/custom-filtering-enterprise-vault
Here is my Default Filter Rules.xml:
<?xml version="1.0"?>
<RULE_SET xmlns="x-schema:ruleset schema.xdr">
<RULE NAME="AntiSpam2" RETENTION="Journaling - 1 Year" CONTENTCATEGORY="HeaderData">
<NAMEDPROP TAG="Header" INCLUDES="ANY">
<PROP VALUE="*INC000012729839*" />
</NAMEDPROP>
</RULE>
</RULE_SET>
The rule is meant to apply a retention of 1 year for any email with the string INC000012729839 in the header.
The key here is having the wildcard symbol ("*") before and after the string.
Here is my Custom Properties.xml"
<?xml version="1.0" encoding="UTF-8"?>
<CUSTOMPROPERTYMETADATA xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="customproperties.xsd">
<!-- 1. DEFINITION OF CONTENT CATEGORIES AVAILABLE -->
<CONTENTCATEGORIES DEFAULT="HeaderData">
<CONTENTCATEGORY NAME="HeaderData">
<INDEXEDPROPERTIES RETRIEVE="Y">
<PROPERTY TAG="Header"/>
</INDEXEDPROPERTIES>
</CONTENTCATEGORY>
</CONTENTCATEGORIES>
<!-- 2. DEFINITION OF CUSTOM PROPERTIES AVAILABLE -->
<CUSTOMPROPERTIES>
<NAMESPACE TYPE="MAPI">
<PROPERTY NAME="0x007D" TAG="Header"/>
</NAMESPACE>
</CUSTOMPROPERTIES>
<!-- 3. DEFINITION OF PRESENTATION PROPERTIES AVAILABLE -->
<PRESENTATION>
<APPLICATION NAME="search.asp" LOCALE="1033">
<FIELDGROUPS>
<FIELDGROUP LABEL="HeaderData">
<FIELD TAG="Header" LABEL="Header" CATEGORY="HeaderData"/>
</FIELDGROUP>
</FIELDGROUPS>
<AVAILABLECATEGORIES>
<AVAILABLECATEGORY CONTENTCATEGORY="HeaderData" LABEL="Header"/>
</AVAILABLECATEGORIES>
</APPLICATION>
</PRESENTATION>
</CUSTOMPROPERTYMETADATA>
The key here is PROPERTY NAME="0x007D" - although OutlookSpy shows a tag number of 0x007D001E for property PR_TRANSPORT_MESSAGE_HEADERS_A, only 0x007D worked.
If you look at P299 of http://www.symantec.com/business/support/library/BUSINESS/DOC6282/10.0.4%20-%20Setting_up_Exchange_S... it says:
If the property is a standard MAPI property, the hexadecimal MAPI property
tag. You can specify just the Identifier part of the 32-bit hexadecimal MAPI
property tag (bits 16 to 31), or the Identifier part (bits 16 to 31) plus the
Property type part (bits 0 to 15). For example, if the MAPI Property tag for a
standard property is 0x0070001E, the Enterprise Vault NAME value could be
specified as either 0x0070001E or 0x0070.
0x007D worked for me, 0x007D001E did not.
Hope this helps other people trying to set this up.
