09-09-2013 04:21 PM
I have been asked to review Ironport's ability to filter "inappropriate" content in email messages.
I am familiar with Ironport's basic source based filtering capabilities based on a sender's reputation as well as its internal dictionaries and "secret sauce" such as that provided in Outbreak Filters. Users also have the ability to create their own dictionaries along with message and content filters to perform their own content filtering. However, I am not familiar with any category based filtering capability that would be the only way I could possibly define "inappropriate". Examples I guess could be taken from the web filtering world such as pornography, adult subjects, violence, drugs, etc.
Users could create their own dictionaries and populate them with specific words those describing parts of the body, certain activities or vulgar language. However I have found from experience with another email filter that a dictionary alone cannot solve the problem since it is the use of these words in context that is the issue (maybe with the exception of vulgar words).
Email filtering is like web filtering in that much of filtering is reputation based, but that is also where they are different. The source of an email can be spoofed or its reputation hijacked simply by taking over a client using an authorized account on google.com, yahoo.com or outlook.com. The reputation or categorization of a web site is more easily fixed.
Do any of you know how to document, enable, enhance or augment Ironport's abilities in the area of screening for "inappropriate" content.
Message was edited by: Ben Klein Interesting - The forum application filtered the word that began with the letter "p" followed by 3 letters and ography that descriptive of an undesirable category of message content, but not vulgar in itself. This is a perfect example of the problem of filtering in this area.
09-12-2013 05:35 AM
Hi Ben,
Automatic filtering takes place by the Ironport Antispam filter.
For a custom filter to match any words, the following article should be helpful:
Knowledge Base Answer ID: 64
http://tools.cisco.com/squish/A018E
Hope this helps,
Stephan
09-13-2013 04:23 PM
Ben,
You're asking for some filtering that blocks things based on the categories you might find on the WSA right? Block all stuff coming from Porn/Adult/whatever...?
There aren't any "category" based filters in the ESA... might make an interesting feature request...
I've had a project on my desk for a while that sort of applies... The dictionairies that the ESA uses a can be regexes and I've got some "language" and "porn" filters from a defunct email product that have stuff like this:
"bad word" and "teen badwording" and "otherbadword" within 5 "badword"
Doable but complex and time consuming... and you have to know regex better than I do...
For now we are using the profanity and sexual content dictionairies, set a few words to 0, and require 3 to hit to stop it...
If its a hit, we put it in the spam quarentine so the user can find it... It catches enough to be useful.
Ken
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide