Turning to FIG. 26, if a rule is created from a reported message (e.g. the reported message in the message summary depicted in FIG. 24), the rule content 1430 may be prepopulated with meta-information from the reported message. When creating a rule from a report, the system identifies summary information from the header of the email, attachments to the email, and URLs in the email to be used in the created rule. If a rule is created from a report, the rule module may also display all of the tabs depicted in the message summary 1200 to allow a user to easily copy and paste strings from one source of information (e.g. header information) into the string editor. As an example, the rule content 1430 may include the sender email address and subject as strings to be used as a match condition. Rule content 1430 that is generated by a user in a rule created from a report will be validated as the user types. Validation ensures that the additional rule content 1430 that is input by a user continuously matches the reported message (i.e. by running the rule against the reported message to ensure that the rule continuously matches the reported message). For example, the rule content may include the sender email address and subject as strings to be used as a match condition
As discussed in more detail below, messages can also be presented in clusters. An interface can be provided by which rules can be created from clusters of reported messages. Similar to creation of a rule from a reported message, a rule created from a cluster may have rule content that is common to all messages assigned to the cluster.
