Kaspersky Lab kaspersky anti-spam 2.0 Manual
Kaspersky Anti-Spam Operation and Filtering Philosophy
31
The
${CATEGORY}
operator can be used when specifying a new
header value. This operator denotes the list of spam categories
obtained based on the message text content analysis. For
example, such list can be entered in the Keywords header.
obtained based on the message text content analysis. For
example, such list can be entered in the Keywords header.
You can modify headers for all users using the common profile,
and headers for users of a particular profile using the
corresponding personal profile.
and headers for users of a particular profile using the
corresponding personal profile.
4.3.4. Filtering profiles and filtering rules
application order
4.3.4.1. Profiles application order
As was mentioned above, filter profiles can be common (their rules are executed
for all recipients of any message) or personal (their rules are executed for
selected recipients).
for all recipients of any message) or personal (their rules are executed for
selected recipients).
Messages are processed according to the following scheme:
1. For the entire message the rules of one common filter profile
3
are
executed. If a rule with a severe action has been executed, which
means canceling all further message processing (see para 4.3.3,
page 28), no other profiles will be applied to this message;
means canceling all further message processing (see para 4.3.3,
page 28), no other profiles will be applied to this message;
2. If the message processing has not been completed and the message
has several recipients, a virtual
4
message copy will be created for
each recipient;
3. The rules of a single personal filter profile are applied to each copy of
a message, or the accept action is executed;
4. At this point message processing finishes. Virtual copies that differ
only in their recipients are "glued" before sending messages to the
recipients and/or before sending rejections to the originators.
recipients and/or before sending rejections to the originators.
Selection of the common profile, which executes at stage 1, is identical for all
processed messages and is performed in a trivial way. The system administrator
can create several common filter profiles using WebConfigurator, however, only
processed messages and is performed in a trivial way. The system administrator
can create several common filter profiles using WebConfigurator, however, only
3
The preinstalled filter profile set provides for the execution of two filter profiles, one of
which (that executes first) - is a hidden profile, that is it cannot be edited using
WebConfigurator. This hidden profile ensures detection of suspicious message headers
and is updated via the Internet automatically along with the content filtering database.
WebConfigurator. This hidden profile ensures detection of suspicious message headers
and is updated via the Internet automatically along with the content filtering database.
4
Copies are "virtual". This means that physical message copies are created only when
they must be processed in different ways for different recipients.