We are looking for a way to filter rules based on messages sent to a specific email in the To: field. There is the option to check the first email in the To: field with email.to[0].address, but that only works if that address is the first email in a potential list of emails. If it’s second or third email, it doesn’t work. I tried to enter mail.to[1].address to string together a series of ‘or’ statements, and so on, but the system wouldn’t allow me to do that.
We’d like the messages filtered anytime the email is sent to a specific email address, regardless of how many other people are on the To: line. The email address we want to filter on is not the final destination mailbox so using email.mailbox doesn’t work in this situation.
I would accomplish this by first creating a new rule to create a global variable that contains all of the email addresses, separated by a pipe (or any other character). For example, I would create global.to_addresses and set it to contain all addresses, like:
|joe@acme.com|jane@acme.com|fred@acme.com|
Then, in any subsequent step, you can check to see if global.to_addresses contains the address you care about, surrounded by pipes (example: |jane@acme.com|).
I like to include the pipe in this way to ensure it’s a full and complete match. For example, I don’t want mary-jane@acme.com to match when searching for jane@acme.com. By including the pipes, |mary-jane@acme.com| won’t match if searching for |jane@acme.com|.
Specifically, here are the steps I would create:
First, a new rule with a single action to render all addresses into a single variable:
The contents of the Text to Render field is |{{implode email.to glue="|" property_name="address"}}| (notice the pipes at the beginning and end, as well is in the “glue” field)
Second, add an expression to the rule you care about:
To get the long free-form entry field, hold SHIFT while clicking the new stanza icon )
Because this is using a regular expression, you must start and begin the expression with a slash /, and then escape all special characters (pipes and periods) with a double-backslash.
Pro-tip: to have MSPintegrations create the escaped regular expression for you, temporarily add any other “contains” stanza and copy the regular expression from the bottom:
Usually, I would create a video to explain something like this, but I’m not able to do that today. Please let me know if this makes sense and if you have any trouble.
)