Bock emails with specific Text message

[mrl_sousa]

Hi

I've a checkpoint R80.10 and the blade "anti-spam and email security" is enable ( High Protection), but i'm receiving "Text" emails with undesired content ( ex." your account has bean hacked.... pay via bitcoin.....) and the email from and to are from the same internal email address ( ex. From : abcde@mydomain.com and To: abcde@mydomain.com) .

I would like to know:

1. Can checkpoint block all emails that came with a specific "TEXT" ( ex." your account has bean hacked.... pay via bitcoin.....) ?

2.  How can i block internal emails with same  "From" and "To" ( ex. From : abcde@mydomain.com  To: abcde@mydomain.com) but coming from my  public ip address  ?

Sorry for the English

Regards,

Mauro

[Ryan_St__Germai]

You could write a few snort rules looking for this and import them into the IPS blade.