Link to home
Start Free TrialLog in
Avatar of OasisEE
OasisEE

asked on

Exchange 2010 Transport Rule Subject Search String in EMC

Trying to figure out how to get my transport rules to work on subject search strings correctly.  Here is an example.

Current subject filter search string:

Thank you for your case! Case#

Because I'm trying to filter and redirect the following subject emails:

Thank you for your case! Case#:233321 - Blahblahblah

However I also catch

RE: Thank you for your case! Case#:233321 - Blahblahblah
and
FW: Thank you for your case! Case#:233321 - Blahblahblah

I tried figuring this out but the transport rule is so important, any interruption was cause an armed insurrection.
Avatar of J0rtIT
J0rtIT
Flag of Venezuela, Bolivarian Republic of image

I already worked with this kind of attacks so This would be my query just fix the start and end time.

$Exported=@()
$Subject = "Thank you for your case! Case"
Get-MessageTrackingLog -Server Mail -Start "07/01/2016 00:00:00" -End "07/25/2016 23:59:59" -MessageSubject  "$Subject"  | where{ $_.Directionality  -eq "Incoming" -and $_.OriginalClientIp -ne ""} | select ComputerName,Timestamp,ClientIp,ClientHostname,ServerIp,Sender,Directionality,OriginalClientIp |  foreach{ $temp = New-Object PSObject -property @{ OriginalClientIp = $_.OriginalClientIp};  $exported+=$temp}
$exported

Open in new window


You will get all the information in the $exported var, from there you can do whatever ( | convertto-json file.json)  (export-csv -notypeinformation here.csv), ( |convertto-html file.html) etc.

ex:
$exported |export-csv -notypeinformation here.csv

Open in new window

Avatar of OasisEE
OasisEE

ASKER

Jose, thank you for answering so quickly.  However this is not a message search.  I am trying to edit a Transport Rule and regular expressions are kinda kickin my ass trying to figure it out.

https://technet.microsoft.com/en-us/library/aa997187%28v=exchg.141%29.aspx?f=255&MSPPError=-2147217396
SOLUTION
Avatar of Vick Vega
Vick Vega
Flag of Canada image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of OasisEE

ASKER

Unfortunately it has to be PRIOR to hitting the mailbox.  Trust me, i would of loved to use simple server-side mailbox rules.
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Answer provided