Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 0 subscribers
  • Views 4951 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Offensive Words

c4t

We have some legitimate emails which has been blocked as offensive word. How to know which words are the cause of the email been blocked?

Here is the copy of the log:

2011-06-13T21:53:07 q=4DF62453_31345_12204_1 f=<prvs=ChaiMingKuang=1382f67ab@dpa.com.sg> t=<Desmond.Chan@farpoint.co.id> pmx_action=quarantine,offensive,-,Desmond.Chan@farpoint.co.id,desmond.chan@farpoint.co.id pmx_reason=offensive vs fur=203.116.117.153 Size=30055 s=?q?RE:_Pavilion_A&A_-_Notes_of_conversation_2011.06.13 r=antispam2.dpa.com.sg tm=0.06 a=d/eom

Here is another sample

2011-06-14T07:36:33 q=4DF6AD10_31345_15477_1 f=<valueconsult@indo.net.id> t=<ruddyanto.gunawan@gunungsewu.com> pmx_action=quarantine,offensive,-,ruddyanto.gunawan@gunungsewu.com,ruddyanto.gunawan@gunungsewu.com pmx_reason=offensive vs fur=202.159.32.56 Size=197042 s=?q?Almost_Running_:_1._Marketing_Research__2._Berbisnis_dengan_Blog__3._Bisnis_Online_Berbasis_News r=smtp-2.indo.net.id tm=1.02 a=d/eom

Both mails are legitimate emails.

Already contacted Sophos support but until now there is no result.

Thanks

:13885


This thread was automatically locked due to age.
  • 0

    Hi,

    In the policy you can use template variables which you can mark the logs for what text was triggered in a list.  The template variables can be found in the online help.  An example of the varilable would be %%MATCHED_TEXT%%.  You would add an action to your offensive word rule that would log the message with key/value pair. 

    Note that if there was more than one offensive word found in a message/document it will only record the first match.

    -Jason

    :13983