1 2 Previous Next 10 Replies Latest reply: Aug 12, 2014 11:40 AM by jatinder2jatin RSS

    Content filtering - MSME 8.0

    jatinder2jatin

      friends my client is receiving loads of SPAMs.. MSME is configured on default with no changes done to the setting as the support engineer told me that by default it is good enough to detect most but my client is getting loads of SPAMS mainly containing obscene words.. things like open atatchinment to get code.. or may be lottery .. etc...

       

      can some one guide me for this.. my current problem is to add these obscene words but i am not sure where is this option. can some one provide me some tutorial or where i can add this.

       

      another thing which may not directly relate here.. in MSME under policy manager there are multiple options one of which is gateway... which i guess we use most of the time.. correct me if i am wrong.. what are other options used for.. screen shot below.

      Mcafee info.png

        • 1. Re: Content filtering - MSME 8.0
          tlange

          are you using ip and message reputation along with the spam scanning?  if not i would suggest to enable them.  also are the spam rules getting updated?  if you look in the gui \dashboad \ Update information tab, what does it show for the Anti-spam engine | Rules Version field?

          • 2. Re: Content filtering - MSME 8.0
            jatinder2jatin

            yes all updated... an engineer was on call with me yesterday and he said he will check with senior members and will get back to me still waiting though...

            can you pelase advise from where to enable or check the option you said above. he checked it yesterday so i guess he might have checked this also. anyways ... is there any ways to get this sorted out ASAP. called gold support but didnt get much

            • 3. Re: Content filtering - MSME 8.0
              tlange

              did you collect any debug logs?  i found the case you opened with us but didn't see any files attached.  if you haven't collected any logs, we would need to get those so we can see what is happening when the spam comes in.

               

              to enable message and ip reputation scanning you would click on Settings and Diagnostics \ Anti-spam

              make sure that message reputation is set to Drop and Quarantine and the threshold is set to 55.

              for ip reputation, the default settings are fine.

               

              then see if that makes a difference in the spam detections.

               

              if these where already enabled then we definitely need to see the debug logs while spam is coming in.


              • 4. Re: Content filtering - MSME 8.0
                jatinder2jatin

                dear TOM just had a long call with an engineer and suddenly got disconnected. anyways.. i have atatched MER and logs to the service request. can you access. Let me know. still loads spams.. code provided by your team to check SPAM is also not detected by MSME

                • 5. Re: Content filtering - MSME 8.0
                  tlange

                  the log shows that msme is properly scanning emails for spam.  there are a couple of emails that got whitelisted and several of the emails are the healthcheck emails exchange sends but nothing seems out of the ordinary.  i did notice that the message reputation score is set to 80 for the threshold.  i would suggest to set this to 55.  i would also look at some of the header files for the emails that look like spam and make sure the score on them is not set at -5000.  based on the msme config there are quite a lot of whitelisted domains and that could prevent some spam from getting caught.

                   

                  can you upload some samples to the sr of spam that got through so i could see what the scores are?  

                  • 6. Re: Content filtering - MSME 8.0
                    jatinder2jatin

                    i did it ... dont think i cn do it here. you want mi to do it here. on service request...

                     

                    and again coming back to same thing.. why cant i block these obscene words.. directly which is provided with other SPAM providers.

                    • 7. Re: Content filtering - MSME 8.0
                      tlange

                      i took a look at the samples and they should get picked up by either the ip or message reputation scanners going forward.  at that point if any do get through to the spam scanner and don't get picked up as spam you can create a content rule to block the messages.

                       

                      for the content filtering:

                      msme 8 has default dlp and compliance rules that you can enabled or you can create a new rule to look for your own specific words.  if you look in the msme product guide there are a couple sections that show you how to do this. 

                      • 8. Re: Content filtering - MSME 8.0
                        jatinder2jatin

                        thanks TOM for supporting me through. I checked the dash board but there are still mails which are getting through. anyways .. can you please guide me where i can create rule in MSME 8 to block specific content. idea is to block obscene words

                        • 9. Re: Content filtering - MSME 8.0
                          tlange

                          the easiest way to go about this is to look at the product guide. it takes you through the process step by step.

                          in the product guide for msme 8 pg 94 it goes through the steps for adding content filter rules to the on-access policy

                          on page 86 it goes through the steps for configuring content rules.

                           

                          you can go to our kb online and pull up the product guide if you don't have access to it locally.  the id for the product guide is PD24248

                          1 2 Previous Next