I realize this isnt exactly a SA question but i figured theres enough people on this list using sare rules to give some feedback. I work in a hospital where we obviously receive a lot of legit emails with drug names in them. However, we also receive a lot of spam with drug names in them as well. I know there are sare rules to catch these sort of things but the question i guess is can these rules distinguish between the two? The difference it seems is that in the legit emails they dont try to hide the drug names and in the spam they do. Before i install some of these rules, i wanted to hear if anyone has had any experience with this type of situation.
Hey Jim.
When I wrote antidrug I was mostly leveling it towards the normal user. However, I don't think it would be too hard to make it OK for a medical environment.
Antidrug tries to penalize drug names lightly, and obfuscated drug names heavily. It also tries to penalize mails with lots of drugs, and mails with combinations of drugs unlikely to be used together for the same condition (ie: Diet pills and pain medication).
You might need to kill off DRUGS_MANYKINDS, but the rest of the rules should be tollerable.
However, I would suggest giving antidrug, or any similar rules, a "trial run" by setting them up with small scores (0.1 or so) to start with and see which ones show up in legitimate mail.
