Rule to check large number of email domains
I have a request to check the sending email address for 625 different domains (xxxxxx.com). If it matches, forward the email to a specific internal mailbox and close out the incident.
Also, check the body of the email for these same 625 domains and take the same action.
The only way I know to do this is to manually code rules to check for matches on any of these. Does anyone have any other recommendations?