Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Ironport False Positives

Hi All,

My Companies email disclaimer has the word 'confidential' in it twice which triggers a Low event.

When a conversation goes back and forth - the number of instances if this word increases, and ultimately pushes the scoring up into Medium, high and Critical.

Does anyone know of a way to configure Ironport to ignore a given body of text?

Thanks All!

Stuart

2 REPLIES
New Member

Ironport False Positives

Not exactly what you are looking for, but another approach would be not to add the disclaimer to messages that already contain it, replies and forwarded emails for example.  You could do this by looking for a string in your disclaimer in the body text and only adding the disclaimer if that text is not there.  There was another question about this late last year which has more details.

Highlighted
New Member

Ironport False Positives

Stuart,

Here's what we do to get around the same problem.  Create a CLI filter rule similar to this:

Don't add disclaimer if it already exist and bypass adding for specific addresses:

no_duplicate_disclaimer: if sendergroup == "RELAYLIST" {

                             if NOT

(mail-from-dictionary-match("Dictionary-NoDisclaimer", 1)) {

                                 if NOT (only-body-contains("keyword", 1)) {

                                     add-footer("Disclaimer");

                                 }

                             }

                         }

The dictionary match contains a list of email addresses that we don't want the disclaimer added to.  These are text notifications sent to phones.

We have been using this since day 1 with our Ironport devices and have not had any problems with it.

Doug

410
Views
0
Helpful
2
Replies
CreatePlease login to create content