Re: using existing score value in new rule's score
Le 23/02/2019 à 01:42, David B Funk a écrit :
IIWY I'd just redefine the HTML_IMAGE_ONLY_XX rules in the form
body __HTML_IMAGE_ONLY_28 eval:html_image_only('2400','2800')
meta HTML_IMAGE_ONLY_28 __HTML_IMAGE_ONLY_28 && !L_O365_USER
That's one way, but given that HTML_IMAGE_ONLY_28 is a core SA rule I'd
prefer not to hack at it.
Alternatively, just set the score of HTML_IMAGE_ONLY_28 to, say, 0.001,
then add a meta rule as above, scored at will.
--
John
Re: using existing score value in new rule's score
On 2/22/19 4:37 PM, David B Funk wrote: > Is there a rule "score" syntax that allows you to use the score assigned > to an existing rule to calculate the value assigned to another rule? > > Specifically what I'm trying to do is to negate the "damage" a > particular rule does for messages that meet particular local criteria. > > For example: "HTML_IMAGE_ONLY_28" is a rule that will assign a modest > number of points to a message that contains a small amount of HTML and > an image. > > What I want to do is to create a local rule: > > meta L_HTML_IMAGE_ONLY_28_FIX ( HTML_IMAGE_ONLY_28 && L_O365_USER ) > describe L_HTML_IMAGE_ONLY_28_FIX Fix damage from > HTML_IMAGE_ONLY_28 for local O-365 users > score L_HTML_IMAGE_ONLY_28_FIX ( -1.0 * HTML_IMAGE_ONLY_28 ) > > Where if HTML_IMAGE_ONLY_28 fires and another rule which detects that > the message was generated by a local Office-365 user, negate the score > from the HTML_IMAGE_ONLY_28 rule. > > My problem is that our campus has switched the bulk of our user > population to Office-365 and many outlook users like to "decorate" their > messages with images (wall-paper, deparmental logos, etc). > When one of these people sends a short message (1~5 lines of text) in > their outlook, it's not unusual for several of SA's rules to fire (EG > DC_GIF_UNO_LARGO, HTML_IMAGE_ONLY_28, SARE_GIF_STOX, etc) which pushes > the messages into spam score range. > > I'd like to automate the un-doing of this damage w/o having to > continually chase after changes in the scoring. > Thus the desire for syntax to calculate the score value. It doesn't have > to be evaluated dynamically, just calculate the score at reload time. > > Thanks. > I use the X-OriginatorOrg header in a meta rule with other headers to subtract a few points (trust) certain Office 365 senders. Otherwise, I treat Office 365 like other "FREEMAIL" sources that are mostly untrusted (add a point or two). You don't have to do the later but the former might be helpful. -- David Jones
Re: using existing score value in new rule's score
On Sat, 23 Feb 2019, RW wrote:
On Fri, 22 Feb 2019 16:37:30 -0600 (CST)
David B Funk wrote:
Is there a rule "score" syntax that allows you to use the score
assigned to an existing rule to calculate the value assigned to
another rule?
...
What I want to do is to create a local rule:
meta L_HTML_IMAGE_ONLY_28_FIX ( HTML_IMAGE_ONLY_28 && L_O365_USER )
describe L_HTML_IMAGE_ONLY_28_FIX Fix damage from
HTML_IMAGE_ONLY_28 for local O-365 users score
L_HTML_IMAGE_ONLY_28_FIX ( -1.0 * HTML_IMAGE_ONLY_28 )
IIWY I'd just redefine the HTML_IMAGE_ONLY_XX rules in the form
body __HTML_IMAGE_ONLY_28 eval:html_image_only('2400','2800')
meta HTML_IMAGE_ONLY_28 __HTML_IMAGE_ONLY_28 && !L_O365_USER
That's one way, but given that HTML_IMAGE_ONLY_28 is a core SA rule I'd prefer
not to hack at it.
I could totally over-ride it with local redefinitions but then I'd miss out on
any updates/improvements to the core rule defs and not know about it.
By just adding my local "repair" rule who's score is derived from that
calculation of the core rule def, I don't need to worry about updates damaging
my intended functionality.
EG: if the system rule is re-scored (up or down) my "repair" will still do the
right thing.
--
Dave Funk University of Iowa
College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_adminIowa City, IA 52242-1527
#include
Better is not better, 'standard' is better. B{
Re: using existing score value in new rule's score
On Fri, 22 Feb 2019 16:37:30 -0600 (CST)
David B Funk wrote:
> Is there a rule "score" syntax that allows you to use the score
> assigned to an existing rule to calculate the value assigned to
> another rule?
...
> What I want to do is to create a local rule:
>
> meta L_HTML_IMAGE_ONLY_28_FIX ( HTML_IMAGE_ONLY_28 && L_O365_USER )
> describe L_HTML_IMAGE_ONLY_28_FIX Fix damage from
> HTML_IMAGE_ONLY_28 for local O-365 users score
> L_HTML_IMAGE_ONLY_28_FIX ( -1.0 * HTML_IMAGE_ONLY_28 )
IIWY I'd just redefine the HTML_IMAGE_ONLY_XX rules in the form
body __HTML_IMAGE_ONLY_28 eval:html_image_only('2400','2800')
meta HTML_IMAGE_ONLY_28 __HTML_IMAGE_ONLY_28 && !L_O365_USER
using existing score value in new rule's score
Is there a rule "score" syntax that allows you to use the score assigned to an
existing rule to calculate the value assigned to another rule?
Specifically what I'm trying to do is to negate the "damage" a particular rule
does for messages that meet particular local criteria.
For example: "HTML_IMAGE_ONLY_28" is a rule that will assign a modest number of
points to a message that contains a small amount of HTML and an image.
What I want to do is to create a local rule:
meta L_HTML_IMAGE_ONLY_28_FIX ( HTML_IMAGE_ONLY_28 && L_O365_USER )
describe L_HTML_IMAGE_ONLY_28_FIX Fix damage from HTML_IMAGE_ONLY_28 for
local O-365 users
score L_HTML_IMAGE_ONLY_28_FIX ( -1.0 * HTML_IMAGE_ONLY_28 )
Where if HTML_IMAGE_ONLY_28 fires and another rule which detects that the
message was generated by a local Office-365 user, negate the score from the
HTML_IMAGE_ONLY_28 rule.
My problem is that our campus has switched the bulk of our user population to
Office-365 and many outlook users like to "decorate" their messages with images
(wall-paper, deparmental logos, etc).
When one of these people sends a short message (1~5 lines of text) in their
outlook, it's not unusual for several of SA's rules to fire (EG
DC_GIF_UNO_LARGO, HTML_IMAGE_ONLY_28, SARE_GIF_STOX, etc) which pushes the
messages into spam score range.
I'd like to automate the un-doing of this damage w/o having to continually
chase after changes in the scoring.
Thus the desire for syntax to calculate the score value. It doesn't have to be
evaluated dynamically, just calculate the score at reload time.
Thanks.
--
Dave Funk University of Iowa
College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_adminIowa City, IA 52242-1527
#include
Better is not better, 'standard' is better. B{
