cancel
Showing results for 
Search instead for 
Did you mean: 
gizmagis
Level 11
Report Inappropriate Content
Message 1 of 12

MSME 7.6 - content filtering problem (sex rule)

Jump to solution

Hi guys,

One of the reason I installed MSME 7.6 and uninstalled GroupShield is also a hope for better content filtering, especially sex rule, however no luck. Content filtering sex rule -> severity high is detecting 100% clean emails with no sex content, even mail with test message "test" and signature (name, phone,...) is detected with this rule. Sex rule -> severity high also detects McAfee email (marketing, Grant numbers, ...) as sex content.

Does anyone else have those problems ? 

Regards,

Gregor

1 Solution

Accepted Solutions
Reliable Contributor Aidan
Reliable Contributor
Report Inappropriate Content
Message 10 of 12

Re: MSME 7.6 - content filtering problem (sex rule)

Jump to solution

If you open the image001 file in notepad (or any txt editor) simply do a search for xxx - it will be found.

Turning that off can be done as explained above.

To change the rule slighly you could turn it into a compound phrase or multiple phrases.

Edit the Sex Severity High Rule - - locate the XXX item in the list - click edit  - select "specify additional contextual words" - "Trigger if All phrases present" within "block of 50 chars" like you could add word like movie  and select "starts with" - so if xxx appears then it looks for other criteria "within 50 chars" before it triggers. i.e. it would look at xxx and then look at next 50 chars for the word movie (or movies)  and if not found - it will not cause a trigger.

These can be expanded if you wish. to include other words which can be associated with XXX.

Again as explained earlier in the thread - these rules can be quite generic and may not suit eveyone - they can be changed or edited and you can create a complete new set of rules based on your particular wants and needs.

11 Replies
Reliable Contributor Aidan
Reliable Contributor
Report Inappropriate Content
Message 2 of 12

Re: MSME 7.6 - content filtering problem (sex rule)

Jump to solution

Hi Gregor,

If you check out the quaratine area of MSME you can select to Add a column - and select Banned Phrase - this will tell you what was actually found . You can Adjust or Edit Rules or even create your own set of rules.

The rules can be quite "generic" - and like the environment you work in may find some things acceptable which another type of workplace won't example the mention of certains diseases, illnesses, afflictions may be acceptable in a Hospital/HealthCare environment  but a lot of that maybe is totally unacceptable in a Bank environment.

You can change/editthese to suit your needs or as stated you can create a completely new set of what you and your company specifically allow/disallow in your environment.

gizmagis
Level 11
Report Inappropriate Content
Message 3 of 12

Re: MSME 7.6 - content filtering problem (sex rule)

Jump to solution

Hi Aidan... i found out that banned phrase was "xxx", however please take a look what was the content of the email....

I can not see any xxx word or phrase. I also checked message headers and there is no xxx phrase... so how can this be blocked ?

______________________________________________________

test

GREGOR JUS

MCTS, McAfee Sales and Technical Professional

Ličer Solutions d.o.o.

Cesta v Gorice 16c, 1000 Ljubljana, Slovenija

Gsm: +386 40 568 750 | E-pošta: gregor.jus@lsi.si

Reliable Contributor Aidan
Reliable Contributor
Report Inappropriate Content
Message 4 of 12

Re: MSME 7.6 - content filtering problem (sex rule)

Jump to solution

Was there an attachment  - do you have "Include Docs and Database formats" and/or "Scan txt of all attacments" enabled?

gizmagis
Level 11
Report Inappropriate Content
Message 5 of 12

Re: MSME 7.6 - content filtering problem (sex rule)

Jump to solution

Hi,

yes include docs and database formats and scan txt of all attachmentes is enabled, however there was no attachment in this test mail...

Should I open support ticket ?

regards,

Gregor

McAfee Employee tlange
McAfee Employee
Report Inappropriate Content
Message 6 of 12

Re: MSME 7.6 - content filtering problem (sex rule)

Jump to solution

the scan text of all attachments caused the issue.  does the signature in the test email have an embedded item?  basically the mime format included some type of attachment that when seen in txt format included the xxx. 

could you download the email from msme detected items database and post it here?

gizmagis
Level 11
Report Inappropriate Content
Message 7 of 12

Re: MSME 7.6 - content filtering problem (sex rule)

Jump to solution

Hi tlange,

it is unpossible to add attachment on this page - community only pictures and video. I can send it to you on email ? I already sent email to Aidan with problematic email. I am waiting what he will discover...

Gregor

Reliable Contributor Aidan
Reliable Contributor
Report Inappropriate Content
Message 8 of 12

Re: MSME 7.6 - content filtering problem (sex rule)

Jump to solution

Gregor,

there is an embeded item - like a signature file - image001.png in the zip you sent. When I open that in notepad - i can find the XXX detail causing trigger.

The image contains the image for "ličersolutions" and is trapped by filter SEX -Severity High. 

To remove this detection - Policy Manager - Shared Resources - Edir the "Sex  Severity High" - edit settings - in Select File Format  - Select e-Mail Messages - select Clear Selections  - then reselect individual items (not "All") but do NOT select  "Text attachments".  

gizmagis
Level 11
Report Inappropriate Content
Message 9 of 12

Re: MSME 7.6 - content filtering problem (sex rule)

Jump to solution

Hi Aidan,

that's grate that you find out the problem. Can you help me with it and "show me" where did you find xxx detail causing trigger ? Well I want to ask, why did image for ličersolutions triggerd filter ? I can't see the benefit of this rule (text attachments) if mcafee e-mails (also grant number) triggers action

Thanks,

Gregor

Reliable Contributor Aidan
Reliable Contributor
Report Inappropriate Content
Message 10 of 12

Re: MSME 7.6 - content filtering problem (sex rule)

Jump to solution

If you open the image001 file in notepad (or any txt editor) simply do a search for xxx - it will be found.

Turning that off can be done as explained above.

To change the rule slighly you could turn it into a compound phrase or multiple phrases.

Edit the Sex Severity High Rule - - locate the XXX item in the list - click edit  - select "specify additional contextual words" - "Trigger if All phrases present" within "block of 50 chars" like you could add word like movie  and select "starts with" - so if xxx appears then it looks for other criteria "within 50 chars" before it triggers. i.e. it would look at xxx and then look at next 50 chars for the word movie (or movies)  and if not found - it will not cause a trigger.

These can be expanded if you wish. to include other words which can be associated with XXX.

Again as explained earlier in the thread - these rules can be quite generic and may not suit eveyone - they can be changed or edited and you can create a complete new set of rules based on your particular wants and needs.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community