Cisco Cisco Email Security Appliance C160 Mode D'Emploi

You can change the positively identified spam threshold to a value between 50 and 99. You can change 
the threshold for suspected spam to any value between 25 and the value you specified for 
positively-identifed spam. 

When you change the thresholds: 

Specifying a lower number (a more aggressive configuration) identifies more messages as spam and 
may produce more false positives. This provides a lower risk that users will see spam but a higher 
risk of having legitimate mail marked as spam.

Specifying a higher number (a more conservative configuration) identifies fewer messages as spam 
and may deliver more spam. This provides a higher risk of users seeing spam but less risk less risk 
that legitimate mail will be withheld as spam. Ideally, if set up correctly, the message subject will 
identify the message as likely spam and message will be delivered. 

You can define separate actions to take on positively-identified and suspected spam. For example, you 
may want to drop “positively identified” spam but quarantine “suspected” spam. 

 

The aggressive example tags only suspected spam messages, while dropping those messages that are 
positively identified. Administrators and end-users can check the subject line of incoming message for 
false positives, and an administrator can adjust, if necessary, the suspected spam threshold. 

In the conservative example, positively identified and suspected spam is delivered with an altered 
subject. Users can delete suspected and positively identified spam. This method is more conservative 
than the first.

For a further discussion of aggressive and conservative policies in mail policies, see 

 in the Mail Policies chapter. 

Drop

Deliver with “

[Positive Spam]

” added 

to the subject of messages, or 

Quarantine 

Deliver with “

[Suspected Spam]

” 

added to the subject of messages

Deliver with “

[Suspected Spam]

” added to 

the subject of messages