NETGEAR STM150 - ProSecure Web And Email Threat Management Appliance Reference Manual page 102

To add a blacklist provider to the real-time blacklist:
1. In the Add Real-time Blacklist section, add the following information:
• In the Provider field, add the name of the blacklist provider.
• In the RBL Domain Suffix field, enter the domain suffix of the blacklist provider.
2. Click the Add table button in the Add column. The new blacklist provider is added to the
Real-Time Blacklist (SMTP) table, and it is disabled by default.
To delete a blacklist provider from the real-time blacklist, click the Delete table button next to
the blacklist provider that you want to delete.
Configuring Distributed Spam Analysis
Spam, phishing, and other email-borne threats consist of millions of messages intentionally
composed differently to evade commonly used filters. Nonetheless, all messages within the
same outbreak share at least one unique, identifiable value that can be used to distinguish
the outbreak.
With distributed spam analysis, message patterns are extracted from the message envelope,
headers, and body with no reference to the content itself. Pattern analysis can then be
applied to identify outbreaks in any language, message format, or encoding type. Message
patterns can be divided into distribution patterns and structure patterns. The STM uses
distribution patterns to determine if the message is legitimate or a potential threat by
analyzing the way it is distributed to the recipients. The STM uses structure patterns to
determine the volume of the distribution.
The STM uses a distributed spam analysis architecture to determine whether or not an email
is spam for SMTP and POP3 emails. Any email that is identified as spam is tagged as spam
(an option for both SMTP and POP3), blocked, or quarantined (the latter two are options
possible only for SMTP).
Note: Unlike other scans, you do not need to configure the spam score
because the NETGEAR Spam Classification Center performs the
scoring automatically as long as the STM is connected to the
Internet. However, this does mean that the STM needs to be
connected to the Internet for the spam analysis to be performed
correctly.
102 | Chapter 4. Content Filtering and Optimizing Scans
ProSecure Web/Email Security Threat Management (STM) Appliance