For the outgoing mail, I found a solution using a "Filtering Rule / Outgoing Rule". As the first line, I have an "Always trigger" rule, with a "copy to another user" action. It copies all outgoing mail to my archiveoutgoing mailbox. At the same time it solves the problem that I had before using the General Ruleset. It does not copy all the internal traffic any more.

For the incoming mail I established a forwarder, as @Brian supposed. Now all  filtered spam is also forwarded to the archives. (I have only one testing set in my Content control and only one spam account. If one had more, he would need a forwarder for each).

Thank you Brian and Joerg.

Like every company, we have to care about email archiving. We use an archiving software on a separate server, that polls mail from two special Mercury accounts, "archiveincoming" and "archiveoutgoing" via POP3.

On the Mercury side, I defined  two rules (Configuration / Filtering rules / Global rules) as the very first rules of my ruleset. The first one copies every mail with a FROM header containing @mycompany.de to the "archiveoutgoing" account. The second one copies every mail with a TO header containing @mycompany.de to the "archiveincoming" account.

However, I also have spamhalter running. In Configuration / Content control, I have a testing set so that any message tagged by Spamhalter shall be "forwarded and then deleted" to a separate account spambox@mycompany.de

After years of fine operation, I found that obviously the "Content control" is processed before the "Filtering rules", so none of the spam mails ever went to the archives.

Normally no problem, but there are sometimes false positives, that also should be archived.

Also, all internal  traffic is archived this way, what I don't need to.

Is there any way to copy out all (external only) traffic before the Content control happens?

If the archiveincoming destination is a mailbox then I think you should be able to use a FORWARD file in the spambox mailbox.  Mercury will then forward a copy of every message that hits that mailbox to the address specified in the FORWARD file.

I guess Spamhalter is taking affect and marking spam mails prior Mercury is checking the user accounts for any FORWARD files. Many of our users have active FORWARD files in place, but I believe spam is never be forwarded.

We have also a separate local spam account in place where Mercury is moving all spam, recognized and marked by Spamhalter, to. This local account "spam" is collecting all spam including any false positives (very rarely). This  separate local spam account is being manually checked by designated users regularly for false positives (one or two times a day, or if anybody is missing an expected mail). In case they find such a false positive, it will be manually forwarded to the corresponsing user. But once marked as "spam", Mercury would immediately sort out this e-mail again and again, when bouncing it to the corresponsing user account. That's why we have an additional general filtering rule in place which is located in front of the "spam sorting out" rule of the filter sequence. This additional filter is searching for sender's address "spam@mydomain.de". To trigger this filter rule, false positives must never be bounced but forwarded (with editing). Means the original sender's address will be exchanged with spam@mydomain.de. And if the filter finds the local spam account sender's address it causes to an exit processing of the rule set, means the "sorting out" filter takes no effect.

Finally we archive only our user accounts but not the spam account. The spam account itself has an own filter in place where all mails are being deleted when they are older than 10 days.