Re: Custom rule based on AWL score

2016-10-24 Thread Paul Stead
On 24/10/16 16:46, John Hardin wrote: Paul: I haven't looked at the plugin myself yet, but here's a suggestion: have a mode where you can mark a RE as capturing a numeric value, and the rule's hit value is the value that the RE captured. This would (for example) let the AWL/TXREP mean be

Re: Custom rule based on AWL score

2016-10-24 Thread Paul Stead
On 24/10/16 16:46, John Hardin wrote: Paul: I haven't looked at the plugin myself yet, but here's a suggestion: have a mode where you can mark a RE as capturing a numeric value, and the rule's hit value is the value that the RE captured. This would (for example) let the AWL/TXREP mean be

Re: Custom rule based on AWL score

2016-10-24 Thread John Hardin
On Mon, 24 Oct 2016, SimpleRezo wrote: So, to the OP: try the tagmatch plugin to look at where _AWLMEAN_ is (e.g.) <= -1 and _AWLCOUNT_ is greater than (e.g.) 10 and that may get you what you want for a meta to use with the rules you want to control. Thank you Paul & John, it looks like I

Re: Custom rule based on AWL score

2016-10-24 Thread SimpleRezo
>So, to the OP: try the tagmatch plugin to look at where _AWLMEAN_ is >(e.g.) <= -1 and _AWLCOUNT_ is greater than (e.g.) 10 and that may get you >what you want for a meta to use with the rules you want to control. Thank you Paul & John, it looks like I will be able to achieve what I want with

Re: Custom rule based on AWL score

2016-10-21 Thread John Hardin
On Fri, 21 Oct 2016, Paul Stead wrote: On 21/10/16 18:40, Paul Stead wrote: On 21/10/16 16:22, John Hardin wrote: > I was going to say: you can't write a rule based on the *current* AWL > adjustment because that's calculated after all the rules have hit. But > SA *could* potentially have a

Re: Custom rule based on AWL score

2016-10-21 Thread Paul Stead
On 21/10/16 18:40, Paul Stead wrote: On 21/10/16 16:22, John Hardin wrote: I was going to say: you can't write a rule based on the *current* AWL adjustment because that's calculated after all the rules have hit. But SA *could* potentially have a rule that checks the current historical average

Re: Custom rule based on AWL score

2016-10-21 Thread Paul Stead
On 21/10/16 18:53, Paul Stead wrote: tagmatch TAGMATCH_TXREP_IP_LOWSCORE _TXREP_IP_MEAN_ /^\-[0-9]{2,}(?:\.[0-9]+)?$/ describe TAGMATCH_TXREP_IP_LOWSCORE TxRep mean score quite low scoreTAGMATCH_TXREP_IP_HIGHSCORE -0.1 Also - typo on score rulename! -- Paul Stead Systems Engineer Zen

Re: Custom rule based on AWL score

2016-10-21 Thread Paul Stead
On 21/10/16 18:40, Paul Stead wrote: A plugin I've developed could be handy here: https://github.com/fmbla/spamassassin-tagmatch tagmatch TAGMATCH_TXREP_IP_HIGHSCORE _TXREP_IP_MEAN_ /^[1-9][0-9]+(?:\.[0-9]+)?$/ describe TAGMATCH_TXREP_IP_HIGHSCORE TXRep mean score quite large score

Re: Custom rule based on AWL score

2016-10-21 Thread Paul Stead
On 21/10/16 16:22, John Hardin wrote: I was going to say: you can't write a rule based on the *current* AWL adjustment because that's calculated after all the rules have hit. But SA *could* potentially have a rule that checks the current historical average that AWL uses... I suggest you file a

Re: Custom rule based on AWL score

2016-10-21 Thread John Hardin
On Fri, 21 Oct 2016, Axb wrote: On 10/21/2016 04:43 PM, Bill Cole wrote: The blocker to that approach has already been stated: they have no mechanism for users to add their contacts to the SA static whitelist. Imo, this you'd normally do at MTA and/or glue level to bypass expensive SA

Re: Custom rule based on AWL score

2016-10-21 Thread John Hardin
On Fri, 21 Oct 2016, Kevin Golding wrote: On Fri, 21 Oct 2016 11:48:41 +0100, simplerezo wrote: > very unknown users can't by definition hit AWL. That's why my wanted rule is score(AWL) > -1 : all users that have not yet send enough not-spam mails can not, for example,

Re: Custom rule based on AWL score

2016-10-21 Thread Axb
On 10/21/2016 04:43 PM, Bill Cole wrote: The blocker to that approach has already been stated: they have no mechanism for users to add their contacts to the SA static whitelist. Imo, this you'd normally do at MTA and/or glue level to bypass expensive SA content scanning and save time &

Re: Custom rule based on AWL score

2016-10-21 Thread Bill Cole
On 20 Oct 2016, at 12:14, Ian Zimmerman wrote: Whitelisted senders get a _huge_ bonus (I think it's 100 points by default, maybe customizable), so they won't be affected if you do it right. The blocker to that approach has already been stated: they have no mechanism for users to add their

Re: Custom rule based on AWL score

2016-10-21 Thread Bowie Bailey
On 10/21/2016 6:48 AM, simplerezo wrote: it also helps frequent spammers known to spam to prevent false negative. Absolutely. very unknown users can't by definition hit AWL. That's why my wanted rule is score(AWL) > -1 : all users that have not yet send enough not-spam mails can not, for

Re: Custom rule based on AWL score

2016-10-21 Thread RW
On Fri, 21 Oct 2016 03:48:41 -0700 (MST) simplerezo wrote: > > it also helps frequent spammers known to spam to prevent false > > negative. > > Absolutely. > > > very unknown users can't by definition hit AWL. > > That's why my wanted rule is score(AWL) > -1 : all users that have > not yet

Re: Custom rule based on AWL score

2016-10-21 Thread simplerezo
> it also helps frequent spammers known to spam to prevent false negative. Absolutely. > very unknown users can't by definition hit AWL. That's why my wanted rule is score(AWL) > -1 : all users that have not yet send enough not-spam mails can not, for example, send me invoices as zip attachment

Re: Custom rule based on AWL score

2016-10-21 Thread Matus UHLAR - fantomas
On 20.10.16 08:34, simplerezo wrote: My understanding is that AWL is helping frequent senders who are known to not send spam to "reduce" their spam score, preventing false positive. it also helps frequent spammers known to spam to prevent false negative. That's exactly what I want to rely

Re: Custom rule based on AWL score

2016-10-20 Thread John Hardin
On Thu, 20 Oct 2016, Bowie Bailey wrote: On 10/20/2016 12:55 PM, David B Funk wrote: On Thu, 20 Oct 2016, John Hardin wrote: > On Thu, 20 Oct 2016, Ian Zimmerman wrote: > > > On 2016-10-20 08:34, simplerezo wrote: > > > > > My understanding is that AWL is helping frequent senders who

Re: Custom rule based on AWL score

2016-10-20 Thread Bowie Bailey
On 10/20/2016 12:55 PM, David B Funk wrote: On Thu, 20 Oct 2016, John Hardin wrote: On Thu, 20 Oct 2016, Ian Zimmerman wrote: On 2016-10-20 08:34, simplerezo wrote: My understanding is that AWL is helping frequent senders who are known to not send spam to "reduce" their spam score,

Re: Custom rule based on AWL score

2016-10-20 Thread David B Funk
On Thu, 20 Oct 2016, John Hardin wrote: On Thu, 20 Oct 2016, Ian Zimmerman wrote: On 2016-10-20 08:34, simplerezo wrote: My understanding is that AWL is helping frequent senders who are known to not send spam to "reduce" their spam score, preventing false positive. That's exactly what I

Re: Custom rule based on AWL score

2016-10-20 Thread John Hardin
On Thu, 20 Oct 2016, Ian Zimmerman wrote: On 2016-10-20 08:34, simplerezo wrote: My understanding is that AWL is helping frequent senders who are known to not send spam to "reduce" their spam score, preventing false positive. That's exactly what I want to rely on for my rules: adding score

Re: Custom rule based on AWL score

2016-10-20 Thread RW
On Thu, 20 Oct 2016 08:34:04 -0700 (MST) simplerezo wrote: > My understanding is that AWL is helping frequent senders who are > known to not send spam to "reduce" their spam score, preventing false > positive. Which is why I pointed you towards a short paragraph that describes what it actually

Re: Custom rule based on AWL score

2016-10-20 Thread Ian Zimmerman
On 2016-10-20 08:34, simplerezo wrote: > My understanding is that AWL is helping frequent senders who are known > to not send spam to "reduce" their spam score, preventing false > positive. That's exactly what I want to rely on for my rules: adding > score for mail with "invoice" pretention and

Re: Custom rule based on AWL score

2016-10-20 Thread simplerezo
My understanding is that AWL is helping frequent senders who are known to not send spam to "reduce" their spam score, preventing false positive. That's exactly what I want to rely on for my rules: adding score for mail with "invoice" pretention and an attachment but only for very unknown users (or

Re: Custom rule based on AWL score

2016-10-20 Thread RW
On Thu, 20 Oct 2016 08:01:17 -0700 (MST) simplerezo wrote: > Because our users cannot easyly add all theirs contacts to whitelist. > > AWL is a great feature, and it's working well: so it would be nice > for us to put some restrictives rules only active for "unknown" users > (example: "invoices"

Re: Custom rule based on AWL score

2016-10-20 Thread simplerezo
Because our users cannot easyly add all theirs contacts to whitelist. AWL is a great feature, and it's working well: so it would be nice for us to put some restrictives rules only active for "unknown" users (example: "invoices" ...). -- View this message in context:

Re: Custom rule based on AWL score

2016-10-20 Thread RW
On Thu, 20 Oct 2016 03:55:29 -0700 (MST) simplerezo wrote: > Hi, > > Is it possible to write rule based on AWL score? No > We have some customs rules that we don't want to enable for > "well-known" contacts... Why not just whitelist them?