Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
1346 Views 11 Replies Latest reply: Mar 5, 2013 3:46 PM by tlange RSS 1 2 Previous Next
onurt Newcomer 3 posts since
Mar 5, 2013
Currently Being Moderated

Mar 5, 2013 6:09 AM

Problem with content scanner

Hi all,

 

I have created a content scanner phrase like "ortak alım". The rule is set to check All email category. the problem is that, the rule is not triggered when the phrase is in the body of the mail. When I put the phrase in subject, the rule is triggered.

 

Any ideas on this?

 

Kind regards,

Onur

 

Message was edited by: onurt on 3/5/13 6:09:09 AM CST
  • Aidan McAfee SME 461 posts since
    Nov 4, 2009
    Currently Being Moderated
    1. Mar 5, 2013 6:30 AM (in response to onurt)
    Re: Problem with content scanner

    Do you mean on the File Format Tab of the "word or phrase"  rule you have created??

    If you deselect all (using clear selection) and put tick in the "everything" box - simply as a test - does it work in the mail body then??

     

    What is exact version of product you are using??

  • tlange McAfee SME 344 posts since
    Nov 4, 2009
    Currently Being Moderated
    3. Mar 5, 2013 9:07 AM (in response to onurt)
    Re: Problem with content scanner

    first you really need to update gse before testing anything further.  the latest patch level for gse 7.01 is patch1 rollup2.  However, i would suggest to upgrade to at least msme 7.6patch1 rollup1 if this is exchange 2003 or msme 8 if this is exchange 2007.  right now you are on the base supported version of gse 7.01 and there are alot of product fixes (over 50) that went into the post sp1 patch and several vulnerability fixes that have been addressed in the rollup that really need to be installed.

     

    as for the phrase not triggering in the body i would look at how the rule is setup.  try adding a wildcard (*) to the beginning and/or end of the rule and see if that fixes the problem. 

         ex:  "*ortak alım"  or  "*ortak alım*"

  • alexn Veteran 722 posts since
    Aug 9, 2012
    Currently Being Moderated
    4. Mar 5, 2013 10:47 AM (in response to tlange)
    Re: Problem with content scanner

    Hi Aidan and tlange,

     

    I have same issue with MSME 7.6, I did according to the previous suggestions, but no luck.

     

    I added simple phrase and complex phrase with * as well. I used  Sender email is not = *@abcd.com

     

    and sender is add is email =abcd@hhhh.com , it did not work in any case.Every thing is getting through.

    Dashboard>under action =clean

     

    Q.2 0-10 is low spam score, so all spam with score 10 are getting in, should I change scor or action to block, will it block legid mails as well with 0 score?


    Post Timings: 6.00 AM to 3.00PM PDT
  • tlange McAfee SME 344 posts since
    Nov 4, 2009
    Currently Being Moderated
    5. Mar 5, 2013 11:14 AM (in response to alexn)
    Re: Problem with content scanner

    remove the complex phrase, it isn't needed.

     

    next setup the rule under the master policy and test that it works there before applying to the sub-policy.

     

    also how are you sending the email for the test?

  • Aidan McAfee SME 461 posts since
    Nov 4, 2009
    Currently Being Moderated
    6. Mar 5, 2013 11:18 AM (in response to alexn)
    Re: Problem with content scanner

    For 1 - not sure its exact issue that Onurt has -unless you're stating that no content rule is working in your system?? Have you tested conent scanning for your configured detail is working first of all before testing it as a subpolicy

                

    For 2 - defaults in the product are - 5 - allow through, 10 - delete and qtine  15 - delete and qtine.

    The higher you make the low score the more likelyhood reall spam will get through

    The lower you set low score the more chance you're gonna catch genuine mail as spam.

    Set low to 4 or 5 

  • alexn Veteran 722 posts since
    Aug 9, 2012
    Currently Being Moderated
    7. Mar 5, 2013 11:38 AM (in response to Aidan)
    Re: Problem with content scanner

    Thank you Aidan, I testd just by sending some emails and they were not blocked.SO could you lem me know how to check if content scaning is working ?


    Post Timings: 6.00 AM to 3.00PM PDT
  • tlange McAfee SME 344 posts since
    Nov 4, 2009
    Currently Being Moderated
    9. Mar 5, 2013 12:36 PM (in response to onurt)
    Re: Problem with content scanner

    what version of exchange are you running?

1 2 Previous Next

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points