Hello Sarah,
The reason some of the samples are not quarantined and some are is not due to the Sender Group matching, but instead it is due to the spam verdict of the samples. Some were seen as clean (could not be identified as spam), and some were seen as suspect spam. The ones that made it, were not identified as spam, while the others were suspect, so the unit sent them to the quarantine.
When you said, "the sender group matches suspect in all ways", this refers to the email entering the appliance. The actual SMTP session ariving at the doorway of the Cisco Email Security Gateway. The doorway to the unit has several sendergroups, these Accept, Reject, Relay or TCPrefuse the SMTP connections. The samples came in via the Suspect Sendergroup, which accepts the emails, albeit throttled.
Once in the appliance, the emails are scanned by AS and AV (plus message and content filters, if those are enabled)
When you said, "i have checked the suspect action and by default are sent to quarantine. why are these emails passing through ??" This refers to what the antispam is configured to do when a sample is suspect. If it spam positive, it would normally drop it, however many customers choose to quarantine these, and review them later. When the sample is suspect, by default it will be sent to the quarantine. The --Suspect-- verdict by Antispam and the -Suspect sender group matching-- are not related. So, while they all came in via the suspect sender group, not all were found to be spam suspect by the antispam enigne.
hopes this clears it up.
Cheers,
-Alvaro
