Trend Micro InterScan M Series, Administrator'S Manual

Page: 67 / 480

How InterScan Gateway Security Appliance Works
3
-
7
InterScan Gateway Security Appliance uses the following components to filter email
messages for spam:
• Trend Micro Anti-Spam Engine
• Approved and Blocked senders lists
• Keyword Exceptions list
• The Email Reputation Services databases
InterScan Gateway Security Appliance applies the Anti-Spam filtering rules to email
messages in the following order: Approved Senders > Blocked Senders > Exception
Keywords.
Note: InterScan Gateway Security Appliance can quarantine messages in the user's spam
mail folder if the Exchange server has the End User Quarantine tool. When spam
messages arrive, the system quarantines them in this folder. End users can access
the spam folder to open, read, or delete suspect spam messages.
The Trend Micro Anti-Spam Engine
The anti-spam engine in InterScan Gateway Security Appliance uses spam patterns
and heuristic rules to filter email messages. It scans email messages and assigns a
spam score to each message based on how closely it matches the rules and patterns
from the pattern file. The Anti-Spam engine compares the spam score to the
user-defined spam detection level. When the spam score exceeds the detection level,
the Anti-Spam engine takes action against the message. The spam detection levels are
as follows:
• Low —this is most lenient level of spam detection. InterScan Gateway Security
Appliance will filter only the most obvious and common spam messages, but
there is a very low chance that it will filter false positives.
• Medium —this is the default setting. InterScan Gateway Security Appliance
monitors at a high level of spam detection with a moderate chance of filtering
false positives.
• High —this is the most rigorous level of spam detection. InterScan Gateway
Security Appliance monitors all email messages for suspicious files or text, but
there is greater chance of false positives.