This section allows you to set custom actions for certain types of messages. For example, you can add rules that will ensure that the messages that are failing the SPF check are rejected directly, instead of being placed in the quarantine.
You can either manually add this rule in this page:
Order: Set the rule order number
Main class (Optional): You can get this from the log search results. For example: phish
Sub class (Optional): Allows you to be more strict with your rule. For example: spf
Extra class (Options): Allows you to be even more specific with your rule
Accept: the message will be accepted by the filter
Reject: the message will be rejected and will not be quarantined
Fake Accept - the message will be quarantined but the sender will not be informed
Quarantine: the message will be quarantined
Quarantine (hidden): the messages are quarantined but cannot be released
Accept and notate: the message will be accepted and delivered to the recipient, with the subject being notated
Blackhole: message will be dropped without informing the sender
The main, sub, and extra classes are regular expressions, which allow you to match more than one class with a single custom action.
However, it is much more convenient to simply add these rules using the Log Search (Preview).
Create the custom log search that you want.
Once the results are returned, use the drop down arrow to the left of the message and select change action for messages like this.
Doing this will take you to the screen above with the fields pre filled.
Once the rule is set, you can use the Drop Down arrow to the left of the rules present in the Customise Actions (preview) section and select: Find similar messages. This will redirect you to the log search where the query based on your rule will be made. The results of that log search will include the messages that are affected by the rule.