I have been noticing that the content filter has been activated for certain words, but I can't seem to (a) figure out what content filter is capturing the message and (b) why the messages are being quarantined when the trigger word is no where in the message. Here is an example (redacted) from the quarantine log:
|Subject :||Re: Life Insurance|
|Date :||10/07/2013 16:29 PDT|
|Status :||Quarantined by Content policy (filter '*** / ***')|
|Sender IP :||209.xx.xx.xx|
Two things to note here: 1. we do not have a content filter for that word and 2. the word does not appear in part of in whole anywhere in the message. Needless to say, this is somewhat frustrating.
Thank you in advance for your help and ideas,
Without knowing what word it is triggering off of, I can't tell exactly which pre-defined filter it is triggering off of. Do you have any of the Content filters (such as Sexual Overtones, Racially Incensitive words, etc.) enabled within your inbound policy? Any custom content policies defined?
Thanks for your quick response. The word is a*s*s (when I copied and pasted it from the original e-mail, it appears that the forum blocked the word). None of the inbound content policies are enabled. As for outbound policies (this was an outbound message), the following content policies are enabled:
ABA Routing Number
Tax Related or Related Data
Credit Card Violations
Social Security Violations
CA Drivers License Law
I would suspect that this filter is from the sexual content outbound filter; however, I can't seem to find the word in question anywhere in the message body -- I've inspected the original message, which is why I am a bit confused as to how that might be triggered.
It would have been triggered by the Sexual Content filter. The keyword may have appeared in the header of the message, but that is certainly something that Support would like to look into further. I would recommend contacting the support team that works with your account (this will either be a partner or McAfee) for further investigation. You'll need to obtain a copy of the original message that was delivered to the recipient as an attachment for a full investigation, as support will need the headers, as well as the content of the message.
I saw this discussion and thought I would add my own questions re: Content Policy Quarantine. I recently turned on Content Policies with notifications to the Recipient. Almost immediately, the filter picked up emails with the phrases "summa cum laude" and "magna cum laude" in their subject line. I quickly realized what the offending word was, but apparently there is no way to remove it from the list of predetermined words under that particular filter.
Also, when the users receive the notification, they check their quarantine but the message is not there, even though when I check from the admin panel, I see the message in their quarantine and release it for them.
Is there some some kind of lag before the user see's messages quarantined by a content filter or is this only available to adminstrators? Lastly, can I modify the notification with a link to their quarantine to make it easier for them to release the message, that is if they even can do it themselves?
Thanks in advance for any advice or suggestions.
The pre-defined lists cannot be edited themselves, however you can copy the list of words into a custom content group, removing the problem words, and using that instead of the pre-defined lists. This will give you additional flexibility to control what words are filtered.
Anything quarantined for a content violation is not visible to the user under their quarantine, as are messages quarantined for viruses or attachment violation. The reason for this is that it is implied that if something outside of spam is bad enough to be quarantined, it is likely desired that that message be reviewed by an appropriate person to determine corporate policy violations and/or the safety of the message.