Learn the possible X-headers that may be added to a message when passed through the Trend Micro Anti-Spam Engine (TMASE) and their corresponding indications on IMSS.
Product Name - Product Version - Anti-Spam Engine Version - Spam Pattern Version
Spam: Yes/NO - Trend Score - Detection Threshold - Category - Trend Type
- The results for all the rules that triggered (X-TM-AS-Result is "Yes") are placed in the X-TM-AS-Result X-header. If no SPS Filter is triggered (X-TM-AS-Result is "No"), only the result of the first rule that processed the messages is placed in the X-TM-AS-Result X-header.
- The Spam score may show -1.813, which will indicate a spam score of "1.813". If the spam score shows --1.813 (two negative signs), this indicates a spam score of "-1.813".
- The 'Trend Type' has value 1 (spam) by default. The value 2 (phish) appears if there is a match in the phish database.
This keeps all the results for each spam or phishing filters which were executed for the message. If a message is processed using multiple SPS Filters, the result for each rule is placed in the X-imss-scan-details X-header, in the sequence by which the rules were applied. In other words, the first entry is for the first rule applied, and the last is for the last rule applied.
This is the Approved Senders List Check. If matched, the message will not be considered a spam. This will match any address in the Approved Sender List.
Report as Spam if the mail sender specified in the header "matches any address in the Blocked Sender List".
Text Exemption Rules / X-Filter Check - report as Not Spam if "any regular expression" is specified in the Text Exemption Rules triggers.
How does IMSS determine if a message is spam or not?
The example below determines how IMSS detects a message as spam:
This shows the results as follows: Spam Yes/No - Trend Score - Detection Threshold Spam Determination is the calculated Trend Score compared with the Detection Threshold. If the Trend Score is higher or equal, the email is classified as spam:
Trend_Score >= Detection_Threshold
The Trend score is determined using all the TMASE rule files and is a sum of the scores for all the matches.
The detection Threshold corresponds to the Administration Console settings configured for the Spam Filter Settings.The results:
Spam: YES because 5.339 >= 5.0 Trend Score: 5.339
Detection Threshold: 5.0