Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

List of spam X-headers and spam scoring in InterScan Messaging Security Suite (IMSS)

    • Updated:
    • 28 Sep 2016
    • Product/Version:
    • InterScan Messaging Security Suite 7.1 Linux
    • InterScan Messaging Security Suite 7.1 Windows
    • InterScan Messaging Security Suite 7.5 Windows
    • InterScan Messaging Security Virtual Appliance 8.2
    • InterScan Messaging Security Virtual Appliance 8.5
    • InterScan Messaging Security Virtual Appliance 9.0
    • Platform:
    • Linux - Red Hat RHEL 4 32-bit
    • Linux - Red Hat RHEL 5 32-bit
    • Linux - Red Hat RHEL 6 32-bit
    • Linux - SuSE 10
    • Linux - SuSE 9.0
    • Unix - Solaris (Sun) version 10 (SunOS 5.10)
    • Unix - Solaris (Sun) version 8 (SunOS 5.8)
    • Unix - Solaris (Sun) version 9 (SunOS 5.9)
    • Windows 2000 Advanced Server
    • Windows 2000 Server
    • Windows 2003 Enterprise
    • Windows 2003 Enterprise Server
    • Windows 2003 Standard
    • Windows 2008 Enterprise
    • Windows 2008 Standard
Summary

Learn the possible X-headers that may be added to a message when passed through the Trend Micro Anti-Spam Engine (TMASE) and their corresponding indications on IMSS.

Details
Public

X-TM-AS-Product-Ver

Product Name - Product Version - Anti-Spam Engine Version - Spam Pattern Version

X-TM-AS-Result

Spam: Yes/NO - Trend Score - Detection Threshold - Category - Trend Type

 
  • The results for all the rules that triggered (X-TM-AS-Result is "Yes") are placed in the X-TM-AS-Result X-header. If no SPS Filter is triggered (X-TM-AS-Result is "No"), only the result of the first rule that processed the messages is placed in the X-TM-AS-Result X-header.
  • The Spam score may show -1.813, which will indicate a spam score of "1.813". If the spam score shows --1.813 (two negative signs), this indicates a spam score of "-1.813".
  • The 'Trend Type' has value 1 (spam) by default. The value 2 (phish) appears if there is a match in the phish database.

X-imss-scan-details

This keeps all the results for each spam or phishing filters which were executed for the message. If a message is processed using multiple SPS Filters, the result for each rule is placed in the X-imss-scan-details X-header, in the sequence by which the rules were applied. In other words, the first entry is for the first rule applied, and the last is for the last rule applied.

X-TM-AS-User-Approved-Sender

This is the Approved Senders List Check. If matched, the message will not be considered a spam. This will match any address in the Approved Sender List.

X-TM-AS-user-Blocked-Sender

Report as Spam if the mail sender specified in the header "matches any address in the Blocked Sender List".

X-TM-AS-Result-Xfilter

Text Exemption Rules / X-Filter Check - report as Not Spam if "any regular expression" is specified in the Text Exemption Rules triggers.

How does IMSS determine if a message is spam or not?

The example below determines how IMSS detects a message as spam:

X-TM-AS-Result: Yes-5.339-5.0-31-1

This shows the results as follows: Spam Yes/No - Trend Score - Detection Threshold Spam Determination is the calculated Trend Score compared with the Detection Threshold. If the Trend Score is higher or equal, the email is classified as spam:

Trend_Score >= Detection_Threshold

The Trend score is determined using all the TMASE rule files and is a sum of the scores for all the matches.

The detection Threshold corresponds to the Administration Console settings configured for the Spam Filter Settings.The results:

X-TM-AS-Result: Yes-5.339-5.0-31-1
Spam: YES because 5.339 >= 5.0 Trend Score: 5.339
Detection Threshold: 5.0

Premium
Internal
Rating:
Category:
Troubleshoot
Solution Id:
1056082
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.