Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
470 Views 6 Replies Latest reply: Oct 23, 2013 10:33 AM by jholley RSS
jboren Newcomer 4 posts since
Dec 4, 2012
Currently Being Moderated

Oct 16, 2013 4:40 PM

Content Policy Quarantine

Hello Folks,

 

I have been noticing that the content filter has been activated for certain words, but I can't seem to (a) figure out what content filter is capturing the message and (b) why the messages are being quarantined when the trigger word is no where in the message. Here is an example (redacted) from the quarantine log:

 

-------------------------------------

From :user@domain.com
To :client@domain.net
Subject :Re: Life Insurance
Date :10/07/2013 16:29 PDT
Status :Quarantined by Content policy (filter '*** / ***')
Sender IP :209.xx.xx.xx
Attachments :
FilenameSizeContent Type
(NONE)15 KBtext/plain
(NONE)27 KBtext/html

Hi Ron,

--------------------------------

 

Two things to note here: 1. we do not have a content filter for that word and 2. the word does not appear in part of in whole anywhere in the message. Needless to say, this is somewhat frustrating.

 

Thank you in advance for your help and ideas,

 

Justin Boren

  • Brad McGarr McAfee Employee 154 posts since
    Dec 4, 2012
    Currently Being Moderated
    1. Oct 16, 2013 4:44 PM (in response to jboren)
    Re: Content Policy Quarantine

    Justin,

     

    Without knowing what word it is triggering off of, I can't tell exactly which pre-defined filter it is triggering off of. Do you have any of the Content filters (such as Sexual Overtones, Racially Incensitive words, etc.) enabled within your inbound policy? Any custom content policies defined?


    Brad McGarr
    McAfee SaaS Email & Web Protection
    Technical Support Technician I (Legacy & Partner Support)
    Microsoft Certified Professional
    Microsoft Technology Associate - Windows OS | CompTIA A+ Certified Technician | CIW Web Foundations Associate
    Visit my blog: Brad's Corner - Insights from SaaS Email & Web Security Support https://community.mcafee.com/blogs/brad-denver

    Frequently Requested Information
  • Brad McGarr McAfee Employee 154 posts since
    Dec 4, 2012
    Currently Being Moderated
    3. Oct 17, 2013 10:11 AM (in response to jboren)
    Re: Content Policy Quarantine

    Justin,

     

    It would have been triggered by the Sexual Content filter. The keyword may have appeared in the header of the message, but that is certainly something that Support would like to look into further. I would recommend contacting the support team that works with your account (this will either be a partner or McAfee) for further investigation. You'll need to obtain a copy of the original message that was delivered to the recipient as an attachment for a full investigation, as support will need the headers, as well as the content of the message.


    Brad McGarr
    McAfee SaaS Email & Web Protection
    Technical Support Technician I (Legacy & Partner Support)
    Microsoft Certified Professional
    Microsoft Technology Associate - Windows OS | CompTIA A+ Certified Technician | CIW Web Foundations Associate
    Visit my blog: Brad's Corner - Insights from SaaS Email & Web Security Support https://community.mcafee.com/blogs/brad-denver

    Frequently Requested Information
  • jholley Newcomer 2 posts since
    Oct 23, 2013
    Currently Being Moderated
    4. Oct 23, 2013 9:39 AM (in response to Brad McGarr)
    Re: Content Policy Quarantine

    Hi Brad,

     

    I saw this discussion and thought I would add my own questions re: Content Policy Quarantine.  I recently turned on Content Policies with notifications to the Recipient.   Almost immediately, the filter picked up emails with the phrases "summa cum laude"  and "magna cum laude" in their subject line.  I quickly realized what the offending word was, but apparently there is no way to remove it from the list of predetermined words under that particular filter.  

     

    Also, when the users receive the notification, they check their quarantine but the message is not there, even though when I check from the admin panel, I see the message in their quarantine and release it for them. 

     

    Is there some some kind of lag before the user see's messages quarantined by a content filter or is this only available to adminstrators?   Lastly, can I modify the notification with a link to their quarantine to make it easier for them to release the message, that is if they even can do it themselves? 

     

    Thanks in advance for any advice or suggestions. 

     

    Jim

  • Brad McGarr McAfee Employee 154 posts since
    Dec 4, 2012
    Currently Being Moderated
    5. Oct 23, 2013 10:24 AM (in response to jholley)
    Re: Content Policy Quarantine

    Jim,

     

    The pre-defined lists cannot be edited themselves, however you can copy the list of words into a custom content group, removing the problem words, and using that instead of the pre-defined lists. This will give you additional flexibility to control what words are filtered.

     

    Anything quarantined for a content violation is not visible to the user under their quarantine, as are messages quarantined for viruses or attachment violation. The reason for this is that it is implied that if something outside of spam is bad enough to be quarantined, it is likely desired that that message be reviewed by an appropriate person to determine corporate policy violations and/or the safety of the message.


    Brad McGarr
    McAfee SaaS Email & Web Protection
    Technical Support Technician I (Legacy & Partner Support)
    Microsoft Certified Professional
    Microsoft Technology Associate - Windows OS | CompTIA A+ Certified Technician | CIW Web Foundations Associate
    Visit my blog: Brad's Corner - Insights from SaaS Email & Web Security Support https://community.mcafee.com/blogs/brad-denver

    Frequently Requested Information
  • jholley Newcomer 2 posts since
    Oct 23, 2013
    Currently Being Moderated
    6. Oct 23, 2013 10:33 AM (in response to Brad McGarr)
    Re: Content Policy Quarantine

    Brad,

     

    I appreciate the prompt response to my inquiries.  Thanks! 

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points