Re[4]: [sniffer] Declude and Sniffer
We're not making a big deal of it just yet, but anyone who would like to switch please do let us know. The bot we have doing this job is very simplistic. We need: Email Address (Account Name), Server name, Password Our bot connects to and logs in with using . Then it pulls and deletes the messages it finds there. We can classify these as either spamtraps (clean spam from email addresses that have never been used for anything) or usertraps (forwarded spam or spam from long dead accounts). Please be sure to let us know precisely what we are looking at ;-) Thanks! _M On Thursday, July 21, 2005, 3:04:50 PM, Darin wrote: DC> Hi Pete, DC> Ok. First I'd heard of it. Do you want us to change the process? If so let DC> me know how to proceed. DC> Darin. DC> - Original Message - DC> From: "Pete McNeil" <[EMAIL PROTECTED]> DC> To: "Darin Cox" DC> Sent: Thursday, July 21, 2005 1:44 PM DC> Subject: Re[2]: [sniffer] Declude and Sniffer DC> On Thursday, July 21, 2005, 12:01:32 PM, Darin wrote: DC>> I thought we were supposed to just forward these as attachments to the DC> spam@ DC>> address? DC> We're trying to move away from that :-) DC> poping the messages is more scalable. DC> _M DC> This E-Mail came from the Message Sniffer mailing list. For information and DC> (un)subscription instructions go to DC> http://www.sortmonster.com/MessageSniffer/Help/Help.html DC> This E-Mail came from the Message Sniffer mailing list. For DC> information and (un)subscription instructions go to DC> http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: [sniffer] Declude and Sniffer
I thought these were matched up by sending address and/or account number to make sure they made it into the appropriate rulebase. In any case, I hadn't heard of this new process. We'll gladly switch if it makes it easier for Pete. Darin. - Original Message - From: "Dan Horne" <[EMAIL PROTECTED]> To: Sent: Thursday, July 21, 2005 1:12 PM Subject: RE: [sniffer] Declude and Sniffer That helps to tune the overall rulebase, but this tunes MY rulebase to the types of spam that we receive. If I send it to the spam@ address it may or may not get added to the rulebase. Done this way, I KNOW it is going to be added to MY rulebase. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox > Sent: Thursday, July 21, 2005 12:02 PM > To: sniffer@SortMonster.com > Subject: Re: [sniffer] Declude and Sniffer > > I thought we were supposed to just forward these as > attachments to the spam@ address? > > Darin. > > > - Original Message - > From: "Dan Horne" <[EMAIL PROTECTED]> > To: > Sent: Thursday, July 21, 2005 11:49 AM > Subject: RE: [sniffer] Declude and Sniffer > > > Get in touch with Pete. They can set that up for you. Basically you > give Pete login info for the blacklist mailbox. They will > automatically > check it and add those emails to your rulebase. > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Kyle Fisher > > Sent: Thursday, July 21, 2005 11:40 AM > > To: sniffer@SortMonster.com > > Subject: RE: [sniffer] Declude and Sniffer > > > > I have about 6,000 accounts and I delete with sniffer well it > > has a weight of 25 with no false positives, but basically > > anything caught by sniffer gets deleted. I delete at 10. > > > > > > > > Dan > > > > How do you setup sniffer so it adds to sniffers rulebase. > > There are some emails I think sniffer should catch but > > doesn't. I would like to set this up. > > > > > > Kyle Fisher > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] > > On Behalf Of Dan Horne > > Sent: Thursday, July 21, 2005 9:48 AM > > To: sniffer@SortMonster.com > > Subject: RE: [sniffer] Declude and Sniffer > > > > I weight sniffer high enough to hold the message on its own. > > We use it as our blacklist and it works great. We get some > > false positives, but we whitelist those and move on. Our > > users forward all spam received in their inbox to an email > > address that the sniffer system checks automatically. It > > adds rules to our sniffer rulebase for all the messages it > > downloads. So next time it comes in it gets held > > automatically. It has been working wonderfully. > > > > Dan Horne > > > > > -Original Message- > > > From: [EMAIL PROTECTED] > > > [mailto:[EMAIL PROTECTED] On Behalf Of John Carter > > > Sent: Wednesday, July 20, 2005 9:16 AM > > > To: sniffer@sortmonster.com > > > Subject: [sniffer] Declude and Sniffer > > > > > > To other Declude users with Sniffer: > > > > > > I currently tag subject lines at 10 and delete at 20. > > > Sniffer results are scored at 9. No two tests currently result in > > > more than 18 and therefore it takes three failed tests to delete. > > > > > > I am considering moving Sniffer to 10. This would tag the subjects > > > based on Sniffer alone, but still required three failed tests to > > > delete. > > > > > > Question: Do any of you tag subject lines based on Sniffer > > alone? My > > > main problem is that some of my users delete based on the tagged > > > subject line. > > > > > > Thanks, > > > John > > > > > > > > > This E-Mail came from the Message Sniffer mailing list. For > > > information and (un)subscription instructions go to > > > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > > > > > This E-Mail came from the Message Sniffer mailing list. For > > information and (un)subscription instructions go to > > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > > > > This E-Mail came from the Message Sniffer mailing list. For > > information and (un)subscription instructions go to > > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > > This E-Mail came from the Message Sniffer mailing list. For > information and > (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] Declude and Sniffer
Hi Pete, Ok. First I'd heard of it. Do you want us to change the process? If so let me know how to proceed. Darin. - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Darin Cox" Sent: Thursday, July 21, 2005 1:44 PM Subject: Re[2]: [sniffer] Declude and Sniffer On Thursday, July 21, 2005, 12:01:32 PM, Darin wrote: DC> I thought we were supposed to just forward these as attachments to the spam@ DC> address? We're trying to move away from that :-) poping the messages is more scalable. _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re[2]: [sniffer] Declude and Sniffer
On Thursday, July 21, 2005, 1:12:18 PM, Dan wrote: DH> That helps to tune the overall rulebase, but this tunes MY rulebase to DH> the types of spam that we receive. If I send it to the spam@ address it DH> may or may not get added to the rulebase. Done this way, I KNOW it is DH> going to be added to MY rulebase. Oh gosh... I'm sorry but that's not really true... slightly more likely, but the messages we pop are used generally. Sorry if I gave you the wrong impression. 99+ % of the time the effect is the same however. _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re[2]: [sniffer] Declude and Sniffer
On Thursday, July 21, 2005, 12:01:32 PM, Darin wrote: DC> I thought we were supposed to just forward these as attachments to the spam@ DC> address? We're trying to move away from that :-) poping the messages is more scalable. _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: [sniffer] Declude and Sniffer
That helps to tune the overall rulebase, but this tunes MY rulebase to the types of spam that we receive. If I send it to the spam@ address it may or may not get added to the rulebase. Done this way, I KNOW it is going to be added to MY rulebase. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox > Sent: Thursday, July 21, 2005 12:02 PM > To: sniffer@SortMonster.com > Subject: Re: [sniffer] Declude and Sniffer > > I thought we were supposed to just forward these as > attachments to the spam@ address? > > Darin. > > > - Original Message - > From: "Dan Horne" <[EMAIL PROTECTED]> > To: > Sent: Thursday, July 21, 2005 11:49 AM > Subject: RE: [sniffer] Declude and Sniffer > > > Get in touch with Pete. They can set that up for you. Basically you > give Pete login info for the blacklist mailbox. They will > automatically > check it and add those emails to your rulebase. > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Kyle Fisher > > Sent: Thursday, July 21, 2005 11:40 AM > > To: sniffer@SortMonster.com > > Subject: RE: [sniffer] Declude and Sniffer > > > > I have about 6,000 accounts and I delete with sniffer well it > > has a weight of 25 with no false positives, but basically > > anything caught by sniffer gets deleted. I delete at 10. > > > > > > > > Dan > > > > How do you setup sniffer so it adds to sniffers rulebase. > > There are some emails I think sniffer should catch but > > doesn't. I would like to set this up. > > > > > > Kyle Fisher > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] > > On Behalf Of Dan Horne > > Sent: Thursday, July 21, 2005 9:48 AM > > To: sniffer@SortMonster.com > > Subject: RE: [sniffer] Declude and Sniffer > > > > I weight sniffer high enough to hold the message on its own. > > We use it as our blacklist and it works great. We get some > > false positives, but we whitelist those and move on. Our > > users forward all spam received in their inbox to an email > > address that the sniffer system checks automatically. It > > adds rules to our sniffer rulebase for all the messages it > > downloads. So next time it comes in it gets held > > automatically. It has been working wonderfully. > > > > Dan Horne > > > > > -Original Message- > > > From: [EMAIL PROTECTED] > > > [mailto:[EMAIL PROTECTED] On Behalf Of John Carter > > > Sent: Wednesday, July 20, 2005 9:16 AM > > > To: sniffer@sortmonster.com > > > Subject: [sniffer] Declude and Sniffer > > > > > > To other Declude users with Sniffer: > > > > > > I currently tag subject lines at 10 and delete at 20. > > > Sniffer results are scored at 9. No two tests currently result in > > > more than 18 and therefore it takes three failed tests to delete. > > > > > > I am considering moving Sniffer to 10. This would tag the subjects > > > based on Sniffer alone, but still required three failed tests to > > > delete. > > > > > > Question: Do any of you tag subject lines based on Sniffer > > alone? My > > > main problem is that some of my users delete based on the tagged > > > subject line. > > > > > > Thanks, > > > John > > > > > > > > > This E-Mail came from the Message Sniffer mailing list. For > > > information and (un)subscription instructions go to > > > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > > > > > This E-Mail came from the Message Sniffer mailing list. For > > information and (un)subscription instructions go to > > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > > > > This E-Mail came from the Message Sniffer mailing list. For > > information and (un)subscription instructions go to > > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > > This E-Mail came from the Message Sniffer mailing list. For > information and > (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: [sniffer] Declude and Sniffer
I thought we were supposed to just forward these as attachments to the spam@ address? Darin. - Original Message - From: "Dan Horne" <[EMAIL PROTECTED]> To: Sent: Thursday, July 21, 2005 11:49 AM Subject: RE: [sniffer] Declude and Sniffer Get in touch with Pete. They can set that up for you. Basically you give Pete login info for the blacklist mailbox. They will automatically check it and add those emails to your rulebase. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Kyle Fisher > Sent: Thursday, July 21, 2005 11:40 AM > To: sniffer@SortMonster.com > Subject: RE: [sniffer] Declude and Sniffer > > I have about 6,000 accounts and I delete with sniffer well it > has a weight of 25 with no false positives, but basically > anything caught by sniffer gets deleted. I delete at 10. > > > > Dan > > How do you setup sniffer so it adds to sniffers rulebase. > There are some emails I think sniffer should catch but > doesn't. I would like to set this up. > > > Kyle Fisher > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] > On Behalf Of Dan Horne > Sent: Thursday, July 21, 2005 9:48 AM > To: sniffer@SortMonster.com > Subject: RE: [sniffer] Declude and Sniffer > > I weight sniffer high enough to hold the message on its own. > We use it as our blacklist and it works great. We get some > false positives, but we whitelist those and move on. Our > users forward all spam received in their inbox to an email > address that the sniffer system checks automatically. It > adds rules to our sniffer rulebase for all the messages it > downloads. So next time it comes in it gets held > automatically. It has been working wonderfully. > > Dan Horne > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of John Carter > > Sent: Wednesday, July 20, 2005 9:16 AM > > To: sniffer@sortmonster.com > > Subject: [sniffer] Declude and Sniffer > > > > To other Declude users with Sniffer: > > > > I currently tag subject lines at 10 and delete at 20. > > Sniffer results are scored at 9. No two tests currently result in > > more than 18 and therefore it takes three failed tests to delete. > > > > I am considering moving Sniffer to 10. This would tag the subjects > > based on Sniffer alone, but still required three failed tests to > > delete. > > > > Question: Do any of you tag subject lines based on Sniffer > alone? My > > main problem is that some of my users delete based on the tagged > > subject line. > > > > Thanks, > > John > > > > > > This E-Mail came from the Message Sniffer mailing list. For > > information and (un)subscription instructions go to > > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: [sniffer] Declude and Sniffer
Get in touch with Pete. They can set that up for you. Basically you give Pete login info for the blacklist mailbox. They will automatically check it and add those emails to your rulebase. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Kyle Fisher > Sent: Thursday, July 21, 2005 11:40 AM > To: sniffer@SortMonster.com > Subject: RE: [sniffer] Declude and Sniffer > > I have about 6,000 accounts and I delete with sniffer well it > has a weight of 25 with no false positives, but basically > anything caught by sniffer gets deleted. I delete at 10. > > > > Dan > > How do you setup sniffer so it adds to sniffers rulebase. > There are some emails I think sniffer should catch but > doesn't. I would like to set this up. > > > Kyle Fisher > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] > On Behalf Of Dan Horne > Sent: Thursday, July 21, 2005 9:48 AM > To: sniffer@SortMonster.com > Subject: RE: [sniffer] Declude and Sniffer > > I weight sniffer high enough to hold the message on its own. > We use it as our blacklist and it works great. We get some > false positives, but we whitelist those and move on. Our > users forward all spam received in their inbox to an email > address that the sniffer system checks automatically. It > adds rules to our sniffer rulebase for all the messages it > downloads. So next time it comes in it gets held > automatically. It has been working wonderfully. > > Dan Horne > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of John Carter > > Sent: Wednesday, July 20, 2005 9:16 AM > > To: sniffer@sortmonster.com > > Subject: [sniffer] Declude and Sniffer > > > > To other Declude users with Sniffer: > > > > I currently tag subject lines at 10 and delete at 20. > > Sniffer results are scored at 9. No two tests currently result in > > more than 18 and therefore it takes three failed tests to delete. > > > > I am considering moving Sniffer to 10. This would tag the subjects > > based on Sniffer alone, but still required three failed tests to > > delete. > > > > Question: Do any of you tag subject lines based on Sniffer > alone? My > > main problem is that some of my users delete based on the tagged > > subject line. > > > > Thanks, > > John > > > > > > This E-Mail came from the Message Sniffer mailing list. For > > information and (un)subscription instructions go to > > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: [sniffer] Declude and Sniffer
I have about 6,000 accounts and I delete with sniffer well it has a weight of 25 with no false positives, but basically anything caught by sniffer gets deleted. I delete at 10. Dan How do you setup sniffer so it adds to sniffers rulebase. There are some emails I think sniffer should catch but doesn't. I would like to set this up. Kyle Fisher -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Horne Sent: Thursday, July 21, 2005 9:48 AM To: sniffer@SortMonster.com Subject: RE: [sniffer] Declude and Sniffer I weight sniffer high enough to hold the message on its own. We use it as our blacklist and it works great. We get some false positives, but we whitelist those and move on. Our users forward all spam received in their inbox to an email address that the sniffer system checks automatically. It adds rules to our sniffer rulebase for all the messages it downloads. So next time it comes in it gets held automatically. It has been working wonderfully. Dan Horne > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of John Carter > Sent: Wednesday, July 20, 2005 9:16 AM > To: sniffer@sortmonster.com > Subject: [sniffer] Declude and Sniffer > > To other Declude users with Sniffer: > > I currently tag subject lines at 10 and delete at 20. > Sniffer results are scored at 9. No two tests currently > result in more than 18 and therefore it takes three failed > tests to delete. > > I am considering moving Sniffer to 10. This would tag the > subjects based on Sniffer alone, but still required three > failed tests to delete. > > Question: Do any of you tag subject lines based on Sniffer > alone? My main problem is that some of my users delete based > on the tagged subject line. > > Thanks, > John > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: [sniffer] Declude and Sniffer
I weight sniffer high enough to hold the message on its own. We use it as our blacklist and it works great. We get some false positives, but we whitelist those and move on. Our users forward all spam received in their inbox to an email address that the sniffer system checks automatically. It adds rules to our sniffer rulebase for all the messages it downloads. So next time it comes in it gets held automatically. It has been working wonderfully. Dan Horne > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of John Carter > Sent: Wednesday, July 20, 2005 9:16 AM > To: sniffer@sortmonster.com > Subject: [sniffer] Declude and Sniffer > > To other Declude users with Sniffer: > > I currently tag subject lines at 10 and delete at 20. > Sniffer results are scored at 9. No two tests currently > result in more than 18 and therefore it takes three failed > tests to delete. > > I am considering moving Sniffer to 10. This would tag the > subjects based on Sniffer alone, but still required three > failed tests to delete. > > Question: Do any of you tag subject lines based on Sniffer > alone? My main problem is that some of my users delete based > on the tagged subject line. > > Thanks, > John > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Declude and Sniffer
My bad. Trying to multi-task isn't working today. :-) John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Wednesday, July 20, 2005 11:13 AM To: John Carter Subject: Re[2]: [sniffer] Declude and Sniffer On Wednesday, July 20, 2005, 12:05:29 PM, John wrote: JC> Thanks, that helps a lot. Didn't understand the replace "nonzero" JC> with the weight number in the Global file. Minor correction... Actually -- you replace "nonzero" with the result code. You adjust the weights at the end of the line as usual. _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re[2]: [sniffer] Declude and Sniffer
On Wednesday, July 20, 2005, 12:05:29 PM, John wrote: JC> Thanks, that helps a lot. Didn't understand the replace "nonzero" with the JC> weight number in the Global file. Minor correction... Actually -- you replace "nonzero" with the result code. You adjust the weights at the end of the line as usual. _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: [sniffer] Declude and Sniffer
Thanks, that helps a lot. Didn't understand the replace "nonzero" with the weight number in the Global file. John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of System Administrator Sent: Wednesday, July 20, 2005 10:27 AM To: Sniffer Subject: Re: [sniffer] Declude and Sniffer on 7/20/05 11:06 AM, John Carter wrote: > I have seen and understand the various Core Rule Group Result Codes, > but am not sure how to separate those out for evaluation. In your global.cfg add lines like the sniffer-scams line below test name - category -- weight SNIFFER-SCAMS external 053 "c:\Sniffer\sniffer2.exe xnk05x5vmipeaof7" 60 0 SNIFFER-PORN external 054 "c:\Sniffer\sniffer2.exe xnk05x5vmipeaof7" 101 0 Add the new tests name to your declude junkmail file(s) also. Greg This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: [sniffer] Declude and Sniffer
on 7/20/05 11:06 AM, John Carter wrote: > I have seen and understand the various Core > Rule Group Result Codes, but am not sure how to separate those out for > evaluation. In your global.cfg add lines like the sniffer-scams line below test name - category -- weight SNIFFER-SCAMS external 053 "c:\Sniffer\sniffer2.exe xnk05x5vmipeaof7" 60 0 SNIFFER-PORN external 054 "c:\Sniffer\sniffer2.exe xnk05x5vmipeaof7" 101 0 Add the new tests name to your declude junkmail file(s) also. Greg This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: [sniffer] Declude and Sniffer
Thanks to everyone (and any to follow later). This has been helpful. Jonathan, could you give me at least one example of coding Declude for a particular Sniffer category? I have seen and understand the various Core Rule Group Result Codes, but am not sure how to separate those out for evaluation. Am I missing something at the Sortmonster or Declude web sites? Thanks again, John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of System Administrator Sent: Wednesday, July 20, 2005 9:38 AM To: Sniffer Subject: Re: [sniffer] Declude and Sniffer on 7/20/05 9:44 AM, Jonathan Schoemann wrote: > Question: Do any of you tag subject lines based on Sniffer alone? My > main problem is that some of my users delete based on the tagged subject line. I weight each category in Sniffer differently. Some messages are deleted by Sniffer alone, some messages have the subject line altered by Sniffer alone and at least one category in Sniffer does nothing visible (other than add some weight to the message). This web page will show you how I weight (RSW column) the various categories. I change the subject at weight 30, delete at 40. http://12.4.184.4/mdlp/ Greg This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: [sniffer] Declude and Sniffer
Hi, > I currently tag subject lines at 10 and delete at 20. Sniffer results are > scored at 9. No two tests currently result in more than 18 and therefore it > takes three failed tests to delete. I tag at 12, hold on 20 and delete on 27. Sniffer is at 19, just 1 under hold. If anything agrees with sniffer it is held, is several sources agree with sniffer it is deleted. We are a prepschool/university and process about 4K to 5K msg a day. I have one to two false positives in the held mail each year. Met vriendelijke groet, Bonno Bloksma --- [E-mail scanned at tio.nl for viruses by Declude Virus] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: [sniffer] Declude and Sniffer
on 7/20/05 9:44 AM, Jonathan Schoemann wrote: > Question: Do any of you tag subject lines based on Sniffer alone? My main > problem is that some of my users delete based on the tagged subject line. I weight each category in Sniffer differently. Some messages are deleted by Sniffer alone, some messages have the subject line altered by Sniffer alone and at least one category in Sniffer does nothing visible (other than add some weight to the message). This web page will show you how I weight (RSW column) the various categories. I change the subject at weight 30, delete at 40. http://12.4.184.4/mdlp/ Greg This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: [sniffer] Declude and Sniffer
Hi John, I do not. As you I score some sniffer tests at 9 and tag the subject at 10. I do occasionaly see fp's with sniffer - particulary with legit newsletters. So what I have done is leave sniffer where it is and combo it up with other tests to push it to and over the 10 threshold. -Nick John Carter wrote: To other Declude users with Sniffer: I currently tag subject lines at 10 and delete at 20. Sniffer results are scored at 9. No two tests currently result in more than 18 and therefore it takes three failed tests to delete. I am considering moving Sniffer to 10. This would tag the subjects based on Sniffer alone, but still required three failed tests to delete. Question: Do any of you tag subject lines based on Sniffer alone? My main problem is that some of my users delete based on the tagged subject line. Thanks, John This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: [sniffer] Declude and Sniffer
I subject tag at 100, hold at 200 and delete at 300. My sniffer weights vary from 100 to 125. - Original Message - From: "John Carter" <[EMAIL PROTECTED]> To: Sent: Wednesday, July 20, 2005 8:16 AM Subject: [sniffer] Declude and Sniffer To other Declude users with Sniffer: I currently tag subject lines at 10 and delete at 20. Sniffer results are scored at 9. No two tests currently result in more than 18 and therefore it takes three failed tests to delete. I am considering moving Sniffer to 10. This would tag the subjects based on Sniffer alone, but still required three failed tests to delete. Question: Do any of you tag subject lines based on Sniffer alone? My main problem is that some of my users delete based on the tagged subject line. Thanks, John This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: [sniffer] Declude and Sniffer
Iset up declude to delete if it fails sniffer. >>> [EMAIL PROTECTED] 07/20/05 09:16AM >>> To other Declude users with Sniffer: I currently tag subject lines at 10 and delete at 20. Sniffer results are scored at 9. No two tests currently result in more than 18 and therefore it takes three failed tests to delete. I am considering moving Sniffer to 10. This would tag the subjects based on Sniffer alone, but still required three failed tests to delete. Question: Do any of you tag subject lines based on Sniffer alone? My main problem is that some of my users delete based on the tagged subject line. Thanks, John This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html THIS MESSAGE IS INTENDED ONLY FOR OFFICIAL BUSINESS USE BY THE INDIVIDUAL OR ENTITY TO WHICH IT IS ADDRESSED. It may contain information that is privileged, confidential and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivery of the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please delete the message and notify the sender so that we may correct our records. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
[sniffer] Declude and Sniffer
To other Declude users with Sniffer: I currently tag subject lines at 10 and delete at 20. Sniffer results are scored at 9. No two tests currently result in more than 18 and therefore it takes three failed tests to delete. I am considering moving Sniffer to 10. This would tag the subjects based on Sniffer alone, but still required three failed tests to delete. Question: Do any of you tag subject lines based on Sniffer alone? My main problem is that some of my users delete based on the tagged subject line. Thanks, John This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
