6 Replies Latest reply: Oct 23, 2013 10:33 AM by jholley RSS

    Content Policy Quarantine

    jboren

      Hello Folks,

       

      I have been noticing that the content filter has been activated for certain words, but I can't seem to (a) figure out what content filter is capturing the message and (b) why the messages are being quarantined when the trigger word is no where in the message. Here is an example (redacted) from the quarantine log:

       

      -------------------------------------

      From :user@domain.com
      To :client@domain.net
      Subject :Re: Life Insurance
      Date :10/07/2013 16:29 PDT
      Status :Quarantined by Content policy (filter '*** / ***')
      Sender IP :209.xx.xx.xx
      Attachments :
      FilenameSizeContent Type
      (NONE)15 KBtext/plain
      (NONE)27 KBtext/html

      Hi Ron,

      --------------------------------

       

      Two things to note here: 1. we do not have a content filter for that word and 2. the word does not appear in part of in whole anywhere in the message. Needless to say, this is somewhat frustrating.

       

      Thank you in advance for your help and ideas,

       

      Justin Boren

        • 1. Re: Content Policy Quarantine
          Brad McGarr

          Justin,

           

          Without knowing what word it is triggering off of, I can't tell exactly which pre-defined filter it is triggering off of. Do you have any of the Content filters (such as Sexual Overtones, Racially Incensitive words, etc.) enabled within your inbound policy? Any custom content policies defined?

          • 2. Re: Content Policy Quarantine
            jboren

            Hi Brad,

             

            Thanks for your quick response. The word is a*s*s (when I copied and pasted it from the original e-mail, it appears that the forum blocked the word). None of the inbound content policies are enabled. As for outbound policies (this was an outbound message), the following content policies are enabled:

             

            ABA Routing Number

            Tax Related or Related Data

            Credit Card Violations

            Social Security Violations

            CA Drivers License Law

            Sexual Content

             

            I would suspect that this filter is from the sexual content outbound filter; however, I can't seem to find the word in question anywhere in the message body -- I've inspected the original message, which is why I am a bit confused as to how that might be triggered.

             

            Thanks,

             

            Justin

            • 3. Re: Content Policy Quarantine
              Brad McGarr

              Justin,

               

              It would have been triggered by the Sexual Content filter. The keyword may have appeared in the header of the message, but that is certainly something that Support would like to look into further. I would recommend contacting the support team that works with your account (this will either be a partner or McAfee) for further investigation. You'll need to obtain a copy of the original message that was delivered to the recipient as an attachment for a full investigation, as support will need the headers, as well as the content of the message.

              • 4. Re: Content Policy Quarantine
                jholley

                Hi Brad,

                 

                I saw this discussion and thought I would add my own questions re: Content Policy Quarantine.  I recently turned on Content Policies with notifications to the Recipient.   Almost immediately, the filter picked up emails with the phrases "summa cum laude"  and "magna cum laude" in their subject line.  I quickly realized what the offending word was, but apparently there is no way to remove it from the list of predetermined words under that particular filter.  

                 

                Also, when the users receive the notification, they check their quarantine but the message is not there, even though when I check from the admin panel, I see the message in their quarantine and release it for them. 

                 

                Is there some some kind of lag before the user see's messages quarantined by a content filter or is this only available to adminstrators?   Lastly, can I modify the notification with a link to their quarantine to make it easier for them to release the message, that is if they even can do it themselves? 

                 

                Thanks in advance for any advice or suggestions. 

                 

                Jim

                • 5. Re: Content Policy Quarantine
                  Brad McGarr

                  Jim,

                   

                  The pre-defined lists cannot be edited themselves, however you can copy the list of words into a custom content group, removing the problem words, and using that instead of the pre-defined lists. This will give you additional flexibility to control what words are filtered.

                   

                  Anything quarantined for a content violation is not visible to the user under their quarantine, as are messages quarantined for viruses or attachment violation. The reason for this is that it is implied that if something outside of spam is bad enough to be quarantined, it is likely desired that that message be reviewed by an appropriate person to determine corporate policy violations and/or the safety of the message.

                  • 6. Re: Content Policy Quarantine
                    jholley

                    Brad,

                     

                    I appreciate the prompt response to my inquiries.  Thanks!