Cisco Cisco Email Security Appliance X1070 Betriebsanweisung
7-5
Cisco IronPort AsyncOS 7.6 for Email Configuration Guide
OL-25136-01
Chapter 7 Reputation Filtering
Figure 7-2
Reputation Filtering Example
Depending on the objectives of your enterprise, you can implement a conservative, moderate, or
aggressive approach.
aggressive approach.
Note
Although Cisco recommends throttling, an alternative for implementing the SenderBase Reputation
Service is to modify the subject line of suspected spam messages. To do this, use the following message
filter shown in
Service is to modify the subject line of suspected spam messages. To do this, use the following message
filter shown in
. This filter uses the
reputation
filter rule and the
strip-header
and
insert-header
filter actions to replace the subject line of messages with a SenderBase Reputation Score
lower than -2.0 with a subject line that includes the actual SenderBase Reputation Score represented as:
{Spam
SBRS
}
. Replace listener_name in this example with the name of your public listener. (The period
on its own line is included so that you can cut and paste this text directly into the command line interface
of the
of the
filters
command.)
Refer to “Using Message Filters to Enforce Email Policies” chapter in the Cisco IronPort AsyncOS for
Email Advanced Configuration Guide. for more information.
Email Advanced Configuration Guide. for more information.
Table 7-1
Message Filter to Modify Subject Header with SBRS: Example 1
sbrs_filter:
if ((recv-inj == "listener_name" AND subject != "\\{Spam -?[0-9.]+\\}"))
{
insert-header("X-SBRS", "$REPUTATION");
if (reputation <= -2.0)
{
strip-header("Subject");
insert-header("Subject", "$Subject \\{Spam $REPUTATION\\}");
}
}
.