topic Anti-SPAM Control analysis in General Topics

Anti-SPAM Control analysis

Ave_Joe — Fri, 04 May 2018 14:27:40 GMT

Anyone have any clue to how interpret the "Control Analysis:" string in log entries for Anti-SPAM?

Here is a sample log entry:

=================

Number: 10374796
Date: 4May2018
Time: 9:17:40
Interface: MTA
Origin: #################
Type: Log
Action: Reject
Service: smtp (25)
Source: mail-bl2nam02lp0086.outbound.protection.outlook.com (207.46.163.86)
Destination: ########
Protocol: tcp
Rule: 0 - Implied Rules
File Direction: to/from this gateway
Product: Anti Spam
Sender: rwkdqdfpp@golfmd.com
Email Session ID: {5AEC6B84-0-1A6464A7-797B07B6}
Email ID: 1
Recipients: #################
Source Country: United States
Spam Category: Spam
Recipients Number: 1
Control Analysis: str=0001.0A0B0203.5AEC6B84.0085,ss=4,re=0.500,recu=0.000,reip=0.000,cl=4,cld=1,fgs=8
Control: Content Anti Spam
Product Family: Network
Policy Info: Policy Name: ##########
Created at: Wed May 02 07:06:25 2018
Installed from: #############

===========================

Re: Anti-SPAM Control analysis

PhoneBoy — Mon, 14 May 2018 17:15:39 GMT

I have not seen any official documentation on this.

Re: Anti-SPAM Control analysis

TP_Master — Tue, 15 May 2018 07:50:10 GMT

Hi!

Control Analysis log field and X-Control-Analysis e-mail header are the same. We inject them to the mails and also in the log and they serve as a "reference ID".

a) You can use this to correlate between the e-mail your end user received to find the matching log in SmartLog.

b) You can use this when reporting a FP/FN.

HTH

Re: Anti-SPAM Control analysis

Ave_Joe — Tue, 15 May 2018 16:21:57 GMT

Thanks for the reply. I am looking for specific details how to read the log entry so I can better understand. Maybe I am missing something?

In the sample:

Control Analysis: str=0001.0A0B0203.5AEC6B84.0085,ss=4,re=0.500,recu=0.000,reip=0.000,cl=4,cld=1,fgs=8

What is each of the field represent?

str= ? (reference id?)

ss =? (spam score?)

re = ?

recu = ?

reip = ?

cl = ?

fgs = ?

Re: Anti-SPAM Control analysis

Alex_Weldon — Tue, 22 May 2018 19:48:53 GMT

Could be unique identifiers used by Cyren / Commtouch. Cyren Support Portal - Security as a Service - 100% Cloud I believe Check Point makes use of their reputation services.