ePrism User Guide - EdgeWave

Anti-Spam Features
Setting Thresholds
STA measures the likelihood of spam for each message it processes. This likelihood is represented
by a number between 0 and 100. The closer to 100, the more likely the message is to be spam. You
can set both an Upper and Lower Threshold. Leave the field blank to disable the action.
It is recommended that you initially set the Upper Threshold to a high value, such as 95, and then
slowly lower it as the training improves. Then set the Lower Threshold, if required.
Messages typically fall into three groups:
• Over 90 — Almost certainly spam.
• Between 55 and 90 — Possibly spam.
• Less than 55 — Almost certainly legitimate mail.
ePrism provides an upper and lower threshold to manage the mail that has been classified.
For each threshold, the range of available actions is as follows:
• Action — The action can be one of the following:
Just log: An entry is made in the log, and no other action is taken.
Modify Subject Header: The text specified in Action Data will be inserted into the message
subject line.
Add header: An "X-" mail header will be added as specified in the Action Data.
Redirect to: The message will be delivered to the mail address specified in Action Data.
Reject mail: The mail will not be accepted, and the connecting mail server is forced to return it.
BCC: The message will be copied to the mail address specified in Action Data.
• Action data — Depending on the specified action:
Modify Subject Header: The specified text will be inserted into the subject line, such as
[STA_SPAM].
Add header: A message header will be added with the specified text, such as [STA_SPAM].
Redirect to: Send the message to a mailbox such as spam@example.com. You can also specify
a domain such as spam.example.com.
Note: The header field can be left blank, if required. If you specify a header such as
[STA_SPAM], the header will be written as "X-Reject: [STA_SPAM]". If you use the form
STA_REJECT:[SPAM], the header will be written as "X-STA_REJECT:[SPAM]".
Rebuild STA
Click the Rebuild STA button to rebuild the STA database. The STA run-time engine is built and
rebuilt at 12 hour intervals using several sources such as the supplied spam data, the DCC spam (if
126