On Mon, 22 Mar 2004, Matt Kettler wrote:
> At 03:49 PM 3/22/2004, Chris Barnes wrote:
> >I am interested in creating a rule that would give extra points if a
> >message appears in multiple blacklists (NABL, SORBS, etc). The idea is
> >that if a message gets a hit in 3 of the BL, it is more likely than a
> >simple additive effect of appearing in each one individually.
> >
> >What would such a rule look like?
>
> Something like this: (2.5x and higher only)
>
> meta
> RCVD_IN_MANY
> (RCVD_IN_DSBL+RCVD_IN_NJABL+RCVD_IN_OPM+RCVD_IN_SORBS) >3
> score RCVD_IN_MANY 2.0
Um, maybe you mean:
meta RCVD_IN_MANY (RCVD_IN_DSBL+RCVD_IN_NJABL+RCVD_IN_OPM+RCVD_IN_SORBS) > 2
describe RCVD_IN_MANY Found in 3 or more DSBLs
score RCVD_IN_MANY 2.0
(watch the line wrap in your mail client).
If you demand that the total be greater than 3 that would require
all listed RBLs to hit (whereas >2 says 3 or more).
If you truely wanted all 4 then it would be more efficient to just use
the boolean '&&' operation. EG:
meta RCVD_IN_MANY (RCVD_IN_DSBL && RCVD_IN_NJABL && RCVD_IN_OPM &&
RCVD_IN_SORBS)
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
