InterScan™ Messaging Security Appliance (IMSA) provides 3 methods of blocking spam mails:
Setting the spam catch rate or detection thresholds
Querying the global network reputation database (NRS)
Monitoring the behaviour of IP addresses
To set the spam catch rate or detection thresholds
Choose Policy > Policy List from the menu.
Click Default spam rule > And scanning conditions match > Spam detection settings.
Configure spam detection settings.
Under Spam/phishing emails on the scanning conditions selection screen, select the check box next to Spam detection settings.
Click Spam detection settings. The Spam detection settings screen appears.
To enable spam scanning, select the check box next to Select a spam catch rate or specify a detection threshold. If you do not select this check box, IMSA will not label any email messages that violate this rule as spam. You can, however, still take actions on any senders in the Blocked Senders list below.
Select one of the following spam catch rates or specify a detection threshold.
High—Catches more spam. Select a high catch rate if too much spam is getting through to your clients.
Medium—Select to catch an average amount of spam (the default selection).
Low—Catches less spam. Select a low catch rate if IMSA is tagging too many legitimate email messages as spam.
Specify a detection threshold—You can specify a threshold value (between 3.0 and 10.0) that represents how critically IMSA analyzes email messages to determine if they are spam.
(click here for more information)
Select the check boxes next to any of the following lists to enable them:
Approved sender list—Prevents IMSA from identifying email from senders in this list as spam.
Blocked sender list—Forces IMSA to identify email from senders in this list as spam.
Text exemption list—Prevents IMSA from identifying email that contains any of the text in this list as spam.
For instructions on configuring the lists, see Configuring Approved and Blocked Sender Lists.
Click Save to continue selecting scanning conditions.
To query the global network reputation database (NRS)
You must first enable NRS.
Choose IP Filtering > Overview from the menu.
To enable NRS, select the NRS check box.
Click Save.
Choose IP Filtering > NRS from the menu.
Select the Enable check box.
Click a radio button next to one of the following:
Default intelligent action—NRS permanently denies connection (550) for RBL+ matches and temporarily denies connection (450) for Zombie matches.
Take customized action for all matches
SMTP error code—Rejects any connection with a certain SMTP code. Type an SMTP code.
SMTP error string—Rejects any connection with a certain SMTP error string. Type the error string.
Click Save.
To monitor the behavior of IP addresses
You must first enable IP Profiler.
Choose IP Filtering > Overview from the menu.
To enable IP profiler, select the IP Profiler check box.
Click Save.
Configure IP Profiler settings.
To configure spam blocking settings:
Choose IP Filtering > Rules from the menu. The Spam tab appears by default. If you are on a different tab, click the Spam tab.
To enable blocking for spam, select the Enable check box.
Configure the following:
Duration to monitor—The number of hours that IMSA monitors email traffic to see if the percentage of spam email messages exceeds the Threshold you set below.
Threshold—The maximum percentage of spam email messages that IMSA will allow during the value you set for Duration to monitor above. The threshold is a fraction with a numerator and denominator:
Rate (%)—Type the maximum number of allowable email messages with spam threats (the numerator).
Total mails—Type the total number of spam email messages out of which the threshold percentage is calculated (the denominator).
Consider the following example. You configure the following:
Duration to monitor: 1 hour at a rate of 20 out of 100
During each one-hour period that spam blocking is active, IMSA starts blocking IP addresses when more than 20% of the messages it receives contain spam and the total number of messages exceeds 100.
Next to Triggering action, select one of the following:
Block temporarily—Block email messages from the IP address and allow the upstream MTA to try again.
Block permanently—Never allow another email message from the IP address and do not allow the upstream MTA to try again.
Click Save.
Trend Micro suggests keeping the default values, which provide an adequate level of protection. To restore the default values, click Restore Defaults.
-----------------------