False Positive

Has this ever been answered?

I'm interested too, wondering if the UTM is learning or wheather it is only reported back to Sophos?

I think this is a different question, Doug.  This has to do with anti-spam, in particular with ctasd (the CommTouch anti spam daemon).  For every incoming email, ctasd calculates a RefID like:

RefID:str=0001.0A02020E.5CCF3583.000E,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0

This is sent to a cloud server at CYREN (formerly CommTouch) that then compares the RefID to its database of RefIDs of known spams and responds with 'Confirmed' (an almost-perfect match with one), 'Bulk' (a close match), 'Suspect' or 'Unknown'.  Bulk is qualified as Spam.  Unknown and Suspect are delivered.

When one reports it as a false positive, this is relayed to CYREN.  I don't know the details of how they use that to automatically update their database.

Cheers - Bob

Thank you for elaborating on this Bob.

Thank you for elaborating on this Bob.