Cisco Cisco Email Security Appliance C160 Mode D'Emploi

7-7

Cisco IronPort AsyncOS 7.5 for Email Configuration Guide

OL-25136-01

Chapter 7 Reputation Filtering

Refer to “Using Message Filters to Enforce Email Policies” chapter in the Cisco
IronPort AsyncOS for Email Advanced Configuration Guide. for more
information.

Table 7-1

Message Filter to Modify Subject Header with SBRS: Example 1

Configuring Reputation Filtering

Configure reputation filtering via the Mail Policies > HAT Overview page. For
more information, see

Implementing SenderBase Reputation Filters, page 7-6

Conservative

A conservative approach is to block messages with a SenderBase Reputation
Score lower than -4.0, throttle between -4.0 and -2.0, apply the default policy
between -2.0 and +6.0, and apply the trusted policy for messages with a score
greater than +6.0. Using this approach ensures a near zero false positive rate while
achieving better system performance.

sbrs_filter:

if ((recv-inj == "listener_name" AND subject != "\\{Spam -?[0-9.]+\\}"))

{

insert-header("X-SBRS", "$REPUTATION");

if (reputation <= -2.0)

{

strip-header("Subject");

insert-header("Subject", "$Subject \\{Spam $REPUTATION\\}");

}