False Positive

Has this ever been answered?

I'm interested too, wondering if the UTM is learning or wheather it is only reported back to Sophos?

Has this ever been answered?

I'm interested too, wondering if the UTM is learning or wheather it is only reported back to Sophos?

I think this is a different question, Doug.  This has to do with anti-spam, in particular with ctasd (the CommTouch anti spam daemon).  For every incoming email, ctasd calculates a RefID like:

RefID:str=0001.0A02020E.5CCF3583.000E,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0

This is sent to a cloud server at CYREN (formerly CommTouch) that then compares the RefID to its database of RefIDs of known spams and responds with 'Confirmed' (an almost-perfect match with one), 'Bulk' (a close match), 'Suspect' or 'Unknown'.  Bulk is qualified as Spam.  Unknown and Suspect are delivered.

When one reports it as a false positive, this is relayed to CYREN.  I don't know the details of how they use that to automatically update their database.

Cheers - Bob

Thank you for elaborating on this Bob.