Joe Kletch wrote: > >>> >>> >>> body L_STOX2 /st0ck\d{2}\s{0,[EMAIL PROTECTED],4}yahoo.com/i >>> >> >> > > I added this rule a while back and removed the yahoo and it seems to > help--but only adds 1.0 to the score and it wasn't enough to put the > mail over my threshold of 3.5. How would I increase the scor it adds? > > Joe Kletch
Change the score line for L_STOX2... and if you don't have one.. add one for crying out loud! All your rules should have a matching score line, unless they are meta-sub-tests and their names start with double underscore (__). Otherwise you're just relying on SA to assign it a default score, which happens to be 1.0. score L_STOX2 1.2