[sanesecurity] OT: help with logging

  • From: Tom Kinghorn <thomas.kinghorn@xxxxxxxxx>
  • To: sanesecurity@xxxxxxxxxxxxx
  • Date: Mon, 05 Sep 2011 13:26:25 +0200

Good afternoon List.

First off, my apologies for posting here but the question is to do with the @virus_
name_to_spam_score_maps.

I have created a custom db, lets say vdc_scam.ndb

Inside the db I have:
Vdc.Spam.6.0:3:*:4f757220636f6d70616e79206f666665727320616c6c206b696e6473206f66206c6f616e20746f20616e7920776865726520696e2074686520776f726c64

where the 1st number is the signature number, the second number is the signature sequence number (where another signature for the same mail type will be 2,3,etc)
and the 3rd number is standard (type of content (email, html etc)

the @virus_name_to_spam_score_maps has

<snip>
[ qr'^INetMsg\.SpamDomain-2w\.' => 3.0 ],
[ qr'^INetMsg\.' => 2.0 ],
[ qr'^MSRBL-Images\.' => 2.1 ],
[ qr'^MSRBL-SPAM\.' => 5.1 ],
[ qr'^MBL_' => undef ], # keep as infected
));
</snip>

How would i add my custom signatures so that they log as spam and not as a virus?
eg :
[ qr'^Vdc\.Spam\.' => 5.1 ],

Thanks in advance.
Tom


Other related posts: