Suhas (QualiSpace) wrote: > Can anybody help me in writing a rule to score the mails with subject "Mail > Server Report"? I am using SA 3.0.1 (windows version) > Here's a rule for ya:
header L_SUBJ_SRV_RPT Subject =~ /Mail Server Report/i describe L_SUBJ_SRV_RPT Stopgap rule for virus flood bypassing AV score L_SUBJ_SRV_RPT 0.5 I'd suggest putting it in with the 0.5 score to start, then raise it after a short time to make sure it's not causing problems
