IronPort - Configuration Guide - AsyncOS 7.6.1

Configuring Reputation Filtering
Conservative
Moderate
Aggressive
7-6
Cisco IronPort AsyncOS 7.6 for Email Configuration Guide
Chapter 7 Reputation Filtering
Configure reputation filtering via the Mail Policies > HAT Overview page. For more information, see
Implementing SenderBase Reputation Filters, page 7-4.
A conservative approach is to block messages with a SenderBase Reputation Score lower than -4.0,
throttle between -4.0 and -2.0, apply the default policy between -2.0 and +6.0, and apply the trusted
policy for messages with a score greater than +6.0. Using this approach ensures a near zero false positive
rate while achieving better system performance.
A moderate approach is to block messages with a SenderBase Reputation Score lower than -3.0, throttle
between -3.0 and 0, apply the default policy between 0 and +6.0, and apply the trusted policy for
messages with a score greater than +6.0. Using this approach ensures a very small false positive rate
while achieving better system performance (because more mail is shunted away from Anti-Spam
processing).
An aggressive approach is to block messages with a SenderBase Reputation Score lower than -2.0,
throttle between -2.0 and 0.5, apply the default policy between 0 and +4.0, and apply the trusted policy
for messages with a score greater than +4.0. Using this approach, you might incur some false positives;
however, this approach maximizes system performance by shunting the most mail away from Anti-Spam
processing.
Note Users are also recommended to assign all messages with a SenderBase Reputation Score greater than 6.0
to the $TRUSTED policy.
Table 7-2 Recommended Phased Approach to Implementing Reputation Filtering using the
SBRS
Policy Blacklist Throttle Default Whitelist
Conservative -10 to -4 -4 to -2 -2 to 7 7 to 10
Moderate -10 to -3 -3 to -1 -1 to 6 6 to 10
Aggressive -10 to -2 -2 to -0.5 -0.5 to 4 4 to 10
Policy: Characteristics: Mail Flow Policy to Apply:
Conservative: Near zero false positives, better performance $BLOCKED
Moderate: Very few false positives, high performance $THROTTLED
Aggressive: Some false positives, maximum performance $DEFAULT
The steps below outline a phased approach to implementing reputation filtering:
OL-25136-01