cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1214
Views
0
Helpful
1
Replies

SBRS reputation filtering and rep. "none"

daro
Level 1
Level 1

Hi guys,

quick question about the behaviour of the reputation filtering action.

If I use for example if (reputation <= 2.0) is there reputation score "none" included?


I usually use this action to keep the false positives low, but if I am doing this I might aswell cover the "none" reputation. It would be cool to have an option in the content filter to in- or exclude "none". 

You see, as soon as I want to have an OR I already have to switch to message filters due to the lacking option of nested boolean operators.

 

thanks

Cheers

Daniel

1 Accepted Solution

Accepted Solutions

dmccabej
Cisco Employee
Cisco Employee

Hello,

 

You can use the if (no reputation) condition via message filter to filter on 'NONE' verdicts. More info and examples can be found within our user guide: here

 

+++

Values for the SenderBase Reputation rule are -10 through 10, but the value NONE may also be returned. To check specifically for the value NONE , use the no-reputation rule.

none_rep:

if (no-reputation) {

strip-header ('Subject');

insert-header ('Subject', '*** Reputation = NONE *** $Subject');

}

+++

Hope that helps! :)

 

Thanks!

-Dennis M.

View solution in original post

1 Reply 1

dmccabej
Cisco Employee
Cisco Employee

Hello,

 

You can use the if (no reputation) condition via message filter to filter on 'NONE' verdicts. More info and examples can be found within our user guide: here

 

+++

Values for the SenderBase Reputation rule are -10 through 10, but the value NONE may also be returned. To check specifically for the value NONE , use the no-reputation rule.

none_rep:

if (no-reputation) {

strip-header ('Subject');

insert-header ('Subject', '*** Reputation = NONE *** $Subject');

}

+++

Hope that helps! :)

 

Thanks!

-Dennis M.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: