This article applies to:
- Trustwave MailMarshal (SEG)
- MailMarshal Exchange 5.1 through 5.3
Question:
- Is it possible to change the score that is assigned by SpamCensor?
- How can I modify SpamCensor scores?
- How can I change the value SpamCensor assigns to a rule?
Procedure:
SpamCensor evaluation scores can be modified using "score adjustment" meta rules. Typically, a meta rule is used to add additional points to the SpamCensor score if several related spam rules trigger. However, it is possible to create a meta rule that triggers on a single spam rule, effectively modifying the score of that rule.
For example, here is a sample SpamCensor result:
1428 09:37:44.578 ------ Category <Spam> evaluation result ------
1428 09:37:44.578 - CONTTYPE_MULTI_ALT: (1.00) Content Type is multipart/alternative
1428 09:37:44.578 - EV_GENR_BothHTMLTxt: (0.00) Both HTML and Text body
1428 09:37:44.578 - EV_GENR_VerySmallBody: (1.00) Msg body is between 100 and 750 bytes
1428 09:37:44.578 - HTML_BGCOLOR: (1.00) HTML uses background color
1428 09:37:44.578 - MIME_NXTPRT_ALL: (1.00) All NextPart MIME Boundary
1428 09:37:44.578 - MIME_NXTPRT_VALID_1: (0.00) Normal NextPart MIME Boundary
1428 09:37:44.578 - MIME_NXTPRT_VALID_3: (1.00) Normal NextPart MIME Boundary
1428 09:37:44.578 - MSGID_OUTLK_EXP: (-3.00) Message-Id is Outlook Express format
1428 09:37:44.578 - MSG_SIZE_1: (-1.00) IsBigger than 1K
1428 09:37:44.578 - RB_GENR_BGColorWhite: (0.00) HTML uses white background
1428 09:37:44.578 - RH_GENR_HeloOneW: (3.00) One word used in Helo
1428 09:37:44.578 - RH_GENR_HeloOneWtoMM: (6.00) One word used in Helo to MM
1428 09:37:44.578 - RH_GENR_NotVerified: (2.00) Received: Not verified
1428 09:37:44.578 - USELESS_STYLE_TAG: (4.00) Style tag does not encompass anything
1428 09:37:44.578 - X_MIME_OLE: (0.00) X-MimeOLE: field present
1428 09:37:44.578 - X_MSMAIL_PRIORITY: (1.00) X-MSMail-Priority: field present
1428 09:37:44.578 Total score: (17.0) required(60.0)
1428 09:37:44.578 SpamFilter: Version 83 6-Dec-2005
1428 09:37:44.578 ------ End of Category >Explicit Spam< evaluation ------
This message attracted a low score, and would not have been caught as spam.
However, suppose we have no desire to ever receive mail generated by Outlook Express. Add the following three lines to Config\UserDefined.xml:
<MetaRules>
<Meta Name="NTS_MTSA_MSGID_OUTLK_EXP" Data="MSGID_OUTLK_EXP" Description="Score Adjustment for MSGID_OUTLK_EXP" Score="43"/>
</MetaRules>
When this configuration is in place the log for a message generated by Outlook Express is as follows:
3688 09:45:58.984 ------ Category <Spam> evaluation result ------
3688 09:45:58.984 - CONTTYPE_MULTI_ALT: (1.00) Content Type is multipart/alternative
3688 09:45:58.984 - EV_GENR_BothHTMLTxt: (0.00) Both HTML and Text body
3688 09:45:58.984 - EV_GENR_VerySmallBody: (1.00) Msg body is between 100 and 750 bytes
3688 09:45:58.984 - HTML_BGCOLOR: (1.00) HTML uses background color
3688 09:45:58.984 - MIME_NXTPRT_ALL: (1.00) All NextPart MIME Boundary
3688 09:45:58.984 - MIME_NXTPRT_VALID_1: (0.00) Normal NextPart MIME Boundary
3688 09:45:58.984 - MIME_NXTPRT_VALID_3: (1.00) Normal NextPart MIME Boundary
3688 09:45:58.984 - MSGID_OUTLK_EXP: (-3.00) Message-Id is Outlook Express format
3688 09:45:58.984 - MSG_SIZE_1: (-1.00) IsBigger than 1K
3688 09:45:58.984 - MTSA_MSGID_OUTLK_EXP: (43.00) Score Adjustment for MSGID_OUTLK_EXP
3688 09:45:58.984 - RB_GENR_BGColorWhite: (0.00) HTML uses white background
3688 09:45:58.984 - RH_GENR_HeloOneW: (3.00) One word used in Helo
3688 09:45:58.984 - RH_GENR_HeloOneWtoMM: (6.00) One word used in Helo to MM
3688 09:45:58.984 - RH_GENR_NotVerified: (2.00) Received: Not verified
3688 09:45:58.984 - USELESS_STYLE_TAG: (4.00) Style tag does not encompass anything
3688 09:45:58.984 - X_MIME_OLE: (0.00) X-MimeOLE: field present
3688 09:45:58.984 - X_MSMAIL_PRIORITY: (1.00) X-MSMail-Priority: field present
3688 09:45:58.984 Total score: (60.0) required(60.0)
3688 09:45:58.984 SpamFilter: Version 83 6-Dec-2005
3688 09:45:58.984 ------ End of Category >Spam< evaluation ------
As you can see, this meta rule effectively changes the result of the MSGID_OUTLK_EXP rule to 40 (43 + -3), causing the SpamCensor to trigger.
Notes:
- This article only provides general guidance in the use of an advanced technique. Some expertise and experimentation will be required to apply this technique effectively. Application of this technique is at the user's discretion and risk.
- For more information about SpamCensor rule names, see the following Trustwave Knowledgebase article:
- Q11107: What are the naming conventions for SpamCensor rules?