Question about scoring with sanesecurity signatures

[Noel Jones]

On 10/10/2012 3:38 PM, Nikolaos Milas wrote:
> On 9/10/2012 6:18 μμ, Noel Jones wrote:
> 
>> n my experience the "FP Risk" column is correct -- I can't remember
>> the last FP from any "Low" list, I'm sure it's been months/millions
>> of messages.  HOWEVER, mileage may vary; my mail is not your mail.
>> You'll need to come up with scores that fit your local policy.
> 
> Thank you Noel for your valuable experience.
> 
> Any experience with No. of FPs from "Medium" lists ?
> 
> Thanks,
> Nick


Occasional FPs from the scamnailer phish list, which blacklists
email addresses used in phishing.  Every month or so, someone one of
the coworkers exchanges mail with (different people - usually at
some .edu) will get their address used in phishing mails.
Unfortunately, these are real people who send out real mail, so I
end up adding them to the local.ign2 file.

Every once in a while a marketing mail will get tagged by one of the
other lists, but I don't worry/care enough about that to pay
attention to which one triggered it.

I will again stress that this is *my* experience, YMMV considerably.


  -- Noel Jones