On Mon, 2011-06-27 at 08:49 -0500, Daniel McDonald wrote: > > body __GREEN_LIAISON1 > /\b(?:proprietary|information|technology|renewables|alternative)\b/i > describe __GREEN_LIAISON1 Remove the emails with green tech spies > tflags __GREEN_LIAISON1 multiple > > body __GREEN_LIAISON2 > /\b(?:Positive|relationship|international|institutions)\b/i > describe __GREEN_LIAISON2 Remove the emails with green tech spies > tflags __GREEN_LIAISON2 multiple > > > header __GREEN_LIAISON3 Subject =~ > /\b(?:Green|renewables|technology|liaison)\b/i > describe __GREEN_LIAISON3 Checking the header for more of the same > tflags __GREEN_LIAISON3 multiple > > meta GREEN_LIAISON __GREEN_LIAISON1 > 2 && __GREEN_LIAISON2 > 2 && > __GREEN_LIAISON3 > 1 > describe GREEN_LIAISON Contains a lot of words found in green tech scams > There's another problem in this and the OP's rule set: Both __GREEN_LIAISON1 and __GREEN_LIAISON3 will fire on the words 'renewables' and 'technology' in the subject line because the subject text is prepended to the body text to form the input for a 'body' rule. This is probably not what the OP wants.
Martin
