End user releasing own emails based on Policy/Content

Ivan17_ironport · ‎09-11-2009

Hiya all,

New to this forum and my first post so hello to all
We recently installed a couple of C360 and an M series and they all are working well.
We have also setup Profanity based filtering and as a result many swear words are being rejected.
This is setup using dictionaries.

But we are also getting a high number of false positives and as a result our Techsupport team is inundated with requests to release emails.
I know with SPAM Quarantine there is End-User Quarantine Access but I don’t see this with Policy Quarantine.

The end result I want is for end users to release their own emails blocked based on profanity.

Is this possible?

My apologies if this has been asked in the past.

Ivan.
:D :D

kluu_ironport · ‎09-11-2009

Welcome aboard Ivan!

The main reason there is a separation between ironport spam quarantine(isq) and policy quarantine(aka system quarantine) is that ISQ is mainly used in conjunction with the anti-spam verdict/results. While policy quarantine is used as a result of administrative/company policy(e.g. like a profanity dictionary filter in your case).

Another difference between the two is ISQ is accessible by the end user. Policy quarantine is accessibly only by the admin of the machine.

Here is a KB article that goes over their diffs.

What is the difference between IronPort Spam Quarantine and System Quarantine?
http://tinyurl.com/233qkq

Now, there is a way to tweak it so that the content filter sends it over to the ISQ. Now keep in mind by doing this, you're mixing profanity filter verdicts with anti-spam results. It may be confusing for the end user unless you preprend the profanity stuff with "[Contains profanity]" at the beginning of the subject line.

This Cisco IronPort support portal KB article goes over how to send content filter results over to the ISQ.

Can a Content Filter divert messages to the IronPort Spam Quarantine?
http://tinyurl.com/coebj3

Good luck and let me know if that doesn't address your concern.

Ivan17_ironport · ‎09-14-2009

Thanks Kevin