HAM/SPAM reporting for SMG 7 on SLES

With the change from Cyren to Bitdefender, the reporting method for submitting false negative
spam messages has changed. Cyren used to allow customers to send in these reports themselves.
Bitdefender requires that support manually submits these. Here is a tid that explains the information
that we will need. Please open a SR and provide the required information. We will then submit
this to Bitdefender on your behalf.

https://support.microfocus.com/kb/doc.php?id=7024731

How to submit Anti-spam false negatives to support

Due to the change in spam scanners in SMG on SLES appliance, spam messages can no longer be submitted through the product itself. They will need to be given to support, whom then can submit them manually.

To do this, do the following:

1) Make sure SMG is up to date. Here is a link to the Manual on how to do that.

2) Open a support ticket. How to contact support.

3) To ensure successful processing it is required to send copies of the original email, in .eml or .msg format, that are being misidentified. If needed, here are some instructions on how to get a copy of the original:

If using GroupWise:

a) Open the email and click on File | Attachments | View.

b) The attachments should now be visible. Right click on Mime.822 and choose 'Retrieve'.

c) Right click again on Mime.822 and choose 'save as'. Save the file, renaming it to something else, such as spam.eml.

If using Outlook, here is a helpful document: https://www.lifewire.com/view-complete-message-source-outlook-1173713

4) Once the messages have been saved, zip them together and attach them to the support SR that was opened. If the zip is too large, they can be uploaded to the FTP server following these guidelines: https://support.microfocus.com/kb/doc.php?id=7019064

After support receives them, in the correct format, they will take steps to get them submitted to help prevent these from getting through in the future.

  • Hi,

    this is not a professional solution, but an artisan solution.

    You can't remove from antispam this function after an upgrade!

    This is a serious thing.

    You must restore this function as soon as possible!

  • Has anything changed on this ham/spam reporting workflow?

  • I don't think so.  I just had to report a couple.  Wondering if there has been any enhancement requests we can vote for.

  • Please, bring HAM/SPAM reporting back to the admin interface. This should be automated in order to reduce manual work and save precious time.

  • Please open a SR and provide the required information. We will then submit
    this to Bitdefender on your behalf.

    It is not my intention to "shoot the messenger" but this is not a workable solution!

    Customers rely on SMG to filter out malicious and unwanted email automatically without impacting valid email. Considering the quantity and variety of spam/malware and the methods used to detect them, there will always be false negatives (and false positives). If, as Micro Focus requires, manual intervention is needed to resolve these issues then SMG fails to provide the protection expected of it.

    If Bitdefender requires that Micro Focus support manually submit requests to deal with these issues then it follows that customers must notify Micro Focus. To limit frivolous requests and track valid ones, requiring customers to open a case appears to be the obvious solution but is it really?

    • If every customer opened a case for every incorrectly assessed email, Micro focus would be inundated with (tens of) thousands of new cases and have to deal with the cost of processing them but, in my opinion, that is quite unlikely to happen.
    • It takes time and effort for a customer to open and track a case, let alone dozens of them.
    • It takes additional effort as described in this thread to obtain and submit an incorrectly assessed email.
    • Because of the volume of spam messages, customers do not normally quarantine spam so there is no sample to submit. To obtain a sample one would have to create an exception but once that is done why proceed further?

    I suspect the majority of customers simply create exceptions and leave it at that. Essentially customers are dealing with most incorrectly assessed email themselves and can't justify the effort to involve Micro Focus.

    The only workable solution and the only one to improve SMG's ability to assess email correctly is to automate this whole process!

    __________
    Kevin Boyle, 
    Knowledge Partner

    Calgary, Alberta, Canada

  • The only workable solution and the only one to improve SMG's ability to assess email correctly is to automate this whole process!

    Please vote for this idea: Add a way to submit false negatives back into the program.

    While the subject refers to false negatives, the comments suggest a larger scope.

    __________
    Kevin Boyle, 
    Knowledge Partner

    Calgary, Alberta, Canada