A white list by subject filter

[ScottLoveland8675309]

I want to create a white list by subject filter.

Our organization sends out messages to members in bulk on certain days. Replies come in with the same title (Re: <the same subject as 10,000 people received). We found that many are dropped as SPAM as our CES detects that there are a lot of messages with the same subject coming in to one account (customer service) at one time.

The challenge is that I want to avoid the Anti-Spam filter by message subject header and I don't seem to be able to do that.

I can create a new filter to white list the messages by subject. I can add that to a new policy but the filter won't be observed until after the Anti-Spam filter has been applied. If I open up the Anti-Spam filter to any sender for any recipient, then I've effectively turned off Anti-SPAM for the company.

1. Does CES filter messages by features in order? Is it always Anti-Spam > Anti-Virus > Advanced Malware Protection > Graymail > Content Filters > Outbreak Filters? Is there a way to change this for some messages (based on subject)?
2. Does anyone have an alternative solution?

[ppreenja]

Hi ,

Please find below answers to your query:

1. Does CES filter messages by features in order? Is it always Anti-Spam > Anti-Virus > Advanced Malware Protection > Graymail > Content Filters > Outbreak Filters? Is there a way to change this for some messages (based on subject)?
- There is no way we can alter the engines' processing email as it is a part of the email pipeline.

2. Does anyone have an alternative solution?
- Alternatively, you can create a message filter as below to skip antispam check for incoming emails:

==============================
SKIP_ANTI_SPAM_SUBJECT: if (subject =="<This is the Subject>") AND (sendergroup != "RELAYLIST")
{
skip-spamcheck();
}
.
========================
Also, if you want to skip graymail engine check as well then you can have the below message filter:

SKIP_ANTI_SPAM_GRAY_SUBJECT: if (subject =="<This is the Subject>") AND (sendergroup != "RELAYLIST")
{
skip-marketingcheck();
skip-socialcheck();
skip-spamcheck();
skip-bulkcheck();
}
.
=================
Note: The message filter can be created via CLI only and make sure you have CLI access to the CES appliance.

Please find below article to have more information on message filters and applying the same:
https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118145-technote-esa-00.html
https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_01000.html

I hope the above helps and answers your query.

Cheers,
Pratham