Cisco Cisco Email Security Appliance C170 Guia Do Utilizador
Chapter 8 Anti-Spam
8-24
Cisco IronPort AsyncOS 7.5 for Email Configuration Guide
OL-25136-01
Positive and Suspect Spam Threshold
When evaluating messages for spam, IronPort Anti-Spam and IronPort Intelligent
Multi-Scan apply thousands of rules in order to arrive at an overall spam score for
the message. To maintain its high accuracy, the both anti-spam solutions by
default set this threshold value quite high. Messages returning a score between 90
and 100 are considered to be positively identified as spam. You can change the
positively identified spam threshold to a value between 75 (most aggressive) and
99 (most conservative). You can configure the anti-spam solution to reflect the
spam tolerance levels of your organization. Both IronPort Anti-Spam and IronPort
Intelligent Multi-Scan provide a configurable Positive and Suspected spam
threshold, applicable per mail policy. This allows you to create an optional
category of “suspected spam” — a gray area of messages that are suspiciously
similar to spam, but also share some traits with legitimate messages.
Multi-Scan apply thousands of rules in order to arrive at an overall spam score for
the message. To maintain its high accuracy, the both anti-spam solutions by
default set this threshold value quite high. Messages returning a score between 90
and 100 are considered to be positively identified as spam. You can change the
positively identified spam threshold to a value between 75 (most aggressive) and
99 (most conservative). You can configure the anti-spam solution to reflect the
spam tolerance levels of your organization. Both IronPort Anti-Spam and IronPort
Intelligent Multi-Scan provide a configurable Positive and Suspected spam
threshold, applicable per mail policy. This allows you to create an optional
category of “suspected spam” — a gray area of messages that are suspiciously
similar to spam, but also share some traits with legitimate messages.
You can change the threshold setting of this new category to different levels of
aggressiveness, so that any messages with scores below the configured suspected
spam range will be considered legitimate, and any messages above the suspected
threshold but below the positive threshold will be considered to be suspected spam
and will be treated accordingly. You can also define a separate action to take on
suspected spam; for example, you may wish to drop “positively identified” spam,
but quarantine “suspected” spam.
aggressiveness, so that any messages with scores below the configured suspected
spam range will be considered legitimate, and any messages above the suspected
threshold but below the positive threshold will be considered to be suspected spam
and will be treated accordingly. You can also define a separate action to take on
suspected spam; for example, you may wish to drop “positively identified” spam,
but quarantine “suspected” spam.
The higher the number you enter, the higher the threshold for IronPort Anti-Spam
rules used to determine if a message qualifies as suspected spam. Enter a lower
number to enable a lower threshold and subsequently mark more messages as
“possible spam” (which may result in a higher false positive rate). Conversely,
enter a higher number if you want to ensure that only spam messages are being
filtered (which may result in some spam getting through). The default value is 50.
See
rules used to determine if a message qualifies as suspected spam. Enter a lower
number to enable a lower threshold and subsequently mark more messages as
“possible spam” (which may result in a higher false positive rate). Conversely,
enter a higher number if you want to ensure that only spam messages are being
filtered (which may result in some spam getting through). The default value is 50.
See
for common
configurations using this two categories.
The suspected spam threshold is set per mail policy for IronPort Anti-Spam.