McAfee SMEFCE-AI-DA Administration Guide - Page 55

Email Protection Administrator Guide Configure a Spam Filter If a Message is Probably Spam (Medium likelihood) area Select an action Email Protection should take if an email has a spam score of 90% or higher: • Tag the message subject with "[SPAM]" - Email Protection adds the phrase "[SPAM]" to the beginning of the email's subject text and sends the email to the recipient. • Quarantine the message - Email Protection sends the email to quarantine. • Deny delivery - Email Protection denies delivery of the email. Note: Emails that have the following actions applied will be reported as Other in the Threats: Spam report. If a Message is Probably Spam (High likelihood) area • Do nothing - Email Protection sends the email to the recipient with no filtering or notification. Select an action Email Protection should take if an email has a spam score of 99.9% or higher. These actions are the same as those for Medium likelihood. 5 Click More Options if you want to enable a Real-time Black Hole List. Otherwise, go to step 8. Multiple real-time blackhole lists (RBLs) of known spammers are provided by the industry, from which Email Protection creates a single RBL indicator to assess the risk of an email originating from a known spammer. The use of multiple blackhole lists to create a single vote and rate the reputation of each RBL for accuracy helps to minimize the possibility of blocking a non-spammer by mistake. 6 If you clicked More Options, click the Enable Real Time Blackhole List (RBL) checkbox. Note: You can also block spammers by completing a Sender Deny List under the policy's Allow/Deny option. 7 Click Save or click on Content Groups under Virus. Define Additional Words That Indicate Spam Email Protection spam content filtering controls spam by comparing the content (subject and body) of an email against predefined lists of keywords or phrases (spam content groups). You can define a custom spam content group that contains additional lists of keywords that are used to filter email as spam. For each content group, you also define the action to take on email that contains a keyword. If the action is to send spam matches to quarantine, users who receive Spam Quarantine Reports can view the matching messages in the quarantine. Note: A spam content group does not analyze the content within attachments. November 2012 Proprietary: Not for use or disclosure outside McAfee without written permission 47