Create policy based on connection ip

Hi

I was wondering if possible to create a policy which will be triggered based on the connection ip (audit log option).The goal is to forward inbound mail comming from a particular ip adress to a secondary e-mail.I tried the folowing thing

Condition:If text in Message header contains 1 or more occurrences of xxx.xxx.xxx.xxx,

Action     :Forward the message to xxxxxx

Thanks in advance