On 2/22/19 4:37 PM, David B Funk wrote: > Is there a rule "score" syntax that allows you to use the score assigned > to an existing rule to calculate the value assigned to another rule? > > Specifically what I'm trying to do is to negate the "damage" a > particular rule does for messages that meet particular local criteria. > > For example: "HTML_IMAGE_ONLY_28" is a rule that will assign a modest > number of points to a message that contains a small amount of HTML and > an image. > > What I want to do is to create a local rule: > > meta L_HTML_IMAGE_ONLY_28_FIX ( HTML_IMAGE_ONLY_28 && L_O365_USER ) > describe L_HTML_IMAGE_ONLY_28_FIX Fix damage from > HTML_IMAGE_ONLY_28 for local O-365 users > score L_HTML_IMAGE_ONLY_28_FIX ( -1.0 * HTML_IMAGE_ONLY_28 ) > > Where if HTML_IMAGE_ONLY_28 fires and another rule which detects that > the message was generated by a local Office-365 user, negate the score > from the HTML_IMAGE_ONLY_28 rule. > > My problem is that our campus has switched the bulk of our user > population to Office-365 and many outlook users like to "decorate" their > messages with images (wall-paper, deparmental logos, etc). > When one of these people sends a short message (1~5 lines of text) in > their outlook, it's not unusual for several of SA's rules to fire (EG > DC_GIF_UNO_LARGO, HTML_IMAGE_ONLY_28, SARE_GIF_STOX, etc) which pushes > the messages into spam score range. > > I'd like to automate the un-doing of this damage w/o having to > continually chase after changes in the scoring. > Thus the desire for syntax to calculate the score value. It doesn't have > to be evaluated dynamically, just calculate the score at reload time. > > Thanks. >
I use the X-OriginatorOrg header in a meta rule with other headers to subtract a few points (trust) certain Office 365 senders. Otherwise, I treat Office 365 like other "FREEMAIL" sources that are mostly untrusted (add a point or two). You don't have to do the later but the former might be helpful. -- David Jones
