cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1087
Views
0
Helpful
2
Replies

Ironport False Positives

stuartkidd1973
Level 1
Level 1

Hi All,

My Companies email disclaimer has the word 'confidential' in it twice which triggers a Low event.

When a conversation goes back and forth - the number of instances if this word increases, and ultimately pushes the scoring up into Medium, high and Critical.

Does anyone know of a way to configure Ironport to ignore a given body of text?

Thanks All!

Stuart

2 Replies 2

David Miller
Level 1
Level 1

Not exactly what you are looking for, but another approach would be not to add the disclaimer to messages that already contain it, replies and forwarded emails for example.  You could do this by looking for a string in your disclaimer in the body text and only adding the disclaimer if that text is not there.  There was another question about this late last year which has more details.

Doug Maxfield
Level 1
Level 1

Stuart,

Here's what we do to get around the same problem.  Create a CLI filter rule similar to this:

Don't add disclaimer if it already exist and bypass adding for specific addresses:

no_duplicate_disclaimer: if sendergroup == "RELAYLIST" {

                             if NOT

(mail-from-dictionary-match("Dictionary-NoDisclaimer", 1)) {

                                 if NOT (only-body-contains("keyword", 1)) {

                                     add-footer("Disclaimer");

                                 }

                             }

                         }

The dictionary match contains a list of email addresses that we don't want the disclaimer added to.  These are text notifications sent to phones.

We have been using this since day 1 with our Ironport devices and have not had any problems with it.

Doug