Tagging [EXTERNAL] on mimecast

Morning All,

So, I've been tasked to create a new Mimecast policy which tags ALL external email with [EXTERNAL] and also drops something in the message body.

Now i'm trying to do this with impersonation protection and I need someone to confirm this is the right way of doing it. I don't want to use stationary to be honest.

So

Go to login-uk.mimecast.com

Log in

Click administration console

Click administration at the top

Go to Gateway

Go to policies

Scroll and click "Impersonation Protection"

Click new policy: Settings bwlo

Policy Narrative  - [external] tagging

EMAILS FROM

Addresses based on Both
Applies from External Addresses
Specifically Applies to all External Senders

Emails to
Applies to Individual email addresses
Specifically "My email"

Now this is where the issue is,  under options I have


So,  I go to lookup, create a new definition and I have no idea what to put in for these specific settings.




Any advice would be awesome. I only want to tag external email and I've read a number of guides but none of them specifically detail how to carry this out. I've been looking into it for a few hours now and frankly. I need some help.

Thank you all

Alex