IronPort - Configuration Guide - AsyncOS 7.6.1

Chapter 9 Anti-Spam
OL-25136-01
Figure 9-11 Cisco IronPort Anti-Spam Settings for a Mail Policy
Positive and Suspect Spam Threshold
When evaluating messages for spam, Cisco IronPort Anti-Spam and Cisco IronPort Intelligent
Multi-Scan apply thousands of rules in order to arrive at an overall spam score for the message. To
maintain its high accuracy, the both anti-spam solutions by default set this threshold value quite high.
Messages returning a score between 90 and 100 are considered to be positively identified as spam. You
can change the positively identified spam threshold to a value between 75 (most aggressive) and 99 (most
conservative). You can configure the anti-spam solution to reflect the spam tolerance levels of your
organization. Both Cisco IronPort Anti-Spam and Cisco IronPort Intelligent Multi-Scan provide a
configurable Positive and Suspected spam threshold, applicable per mail policy. This allows you to
create an optional category of “suspected spam” — a gray area of messages that are suspiciously similar
to spam, but also share some traits with legitimate messages.
You can change the threshold setting of this new category to different levels of aggressiveness, so that
any messages with scores below the configured suspected spam range will be considered legitimate, and
any messages above the suspected threshold but below the positive threshold will be considered to be
suspected spam and will be treated accordingly. You can also define a separate action to take on
suspected spam; for example, you may wish to drop “positively identified” spam, but quarantine
“suspected” spam.
The higher the number you enter, the higher the threshold for Cisco IronPort Anti-Spam rules used to
determine if a message qualifies as suspected spam. Enter a lower number to enable a lower threshold
and subsequently mark more messages as “possible spam” (which may result in a higher false positive
rate). Conversely, enter a higher number if you want to ensure that only spam messages are being filtered
(which may result in some spam getting through). The default value is 50. See Positively Identified
versus Suspected Spam, page 9-16 for common configurations using this two categories.
The suspected spam threshold is set per mail policy for Cisco IronPort Anti-Spam.
Cisco IronPort AsyncOS 7.6 for Email Configuration Guide
9-15