My company currently receives vast amounts of UCE... SpamAssassin has been doing a pretty decent job of tagging spam and I am currently working on training the Bayes filters to make it even more effective. I am not currently not blocking any mail - for selected users, I have my production mail server forwarding a duplicate message to my spam filter machine, which in turn runs the tests, redirects spam to a "junk" mailbox and good mail to a "ham" mailbox. I currently use these mailboxes to train my Bayes filters, moving messages to the appropriate mailbox if necessary.
When I begin blocking for real, I will not want keep a duplicate of every mail message we get but a quarantine will be necessary. I will probably still use a mailbox for quarantine purposes, but I do not want every message that fails the tests to be kept. Any message that scores above a certain number, say 20.0, I would like to drop without quarantining since I would be pretty certain that it wouldn't be spam. Then my quarantine would only contain mail items that scored between my kill threshold and 20.0.
Is there something built in that enables me to do this, or has anyone monkey'd around with SA and figured this out?
Thanks in advance
