Define Additional Words That Indicate Spam - McAfee SMEFCE-AI-DA - Email Security Service Inbound Administration Manual

Email Protection Administrator Guide
If a Message is
Probably Spam
(Medium
likelihood) area
If a Message is
Probably Spam
(High likelihood)
area
5 Click More Options if you want to enable a Real-time Black Hole List. Otherwise, go
to step 8.
Multiple real-time blackhole lists (RBLs) of known spammers are provided by the
industry, from which Email Protection creates a single RBL indicator to assess the risk
of an email originating from a known spammer. The use of multiple blackhole lists to
create a single vote and rate the reputation of each RBL for accuracy helps to
minimize the possibility of blocking a non-spammer by mistake.
6 If you clicked More Options, click the Enable Real Time Blackhole List (RBL)
checkbox.
Note: You can also block spammers by completing a Sender Deny List under the
policy's Allow/Deny option.
7 Click Save or click on Content Groups under Virus.
Define Additional Words That Indicate
Spam
Email Protection spam content filtering controls spam by comparing the content (subject
and body) of an email against predefined lists of keywords or phrases (spam content
groups).
You can define a custom spam content group that contains additional lists of keywords
that are used to filter email as spam. For each content group, you also define the action to
take on email that contains a keyword. If the action is to send spam matches to quarantine,
users who receive Spam Quarantine Reports can view the matching messages in the
quarantine.
Note: A spam content group does not analyze the content within attachments.
November 2012 Proprietary: Not for use or disclosure outside McAfee without written permission
Select an action Email Protection should take if an email has a spam score
of 90% or higher:
• Tag the message subject with "[SPAM]" – Email Protection adds
the phrase "[SPAM]" to the beginning of the email's subject text and
sends the email to the recipient.
• Quarantine the message – Email Protection sends the email to
quarantine.
• Deny delivery – Email Protection denies delivery of the email.
Note: Emails that have the following actions applied will be
reported as Other in the Threats: Spam report.
• Do nothing – Email Protection sends the email to the recipient with
no filtering or notification.
Select an action Email Protection should take if an email has a spam score
of 99.9% or higher. These actions are the same as those for Medium
likelihood.
Configure a Spam Filter
47