cloud-api profile weighted-analysis
Use this command to configure weighted analysis profiles for the administrator account of the Microsoft 365 and Google Workspace domain. To avoid false positives and false negatives, you can adjust the scores ("weight") of each type of suspicious behavior, and the total score threshold that an email must reach to be categorized as spam.
To use a weighted analysis profile, select it in an antispam profile.
Syntax
config profile weighted-analysis
edit <profile_name>
config rule
edit <order_index>
set name <rule_name>
set action-keyword-score <score_float>
set cousin-domain-score <score_float>
set dictionary-profile <profile_name>
set dictionary-threshold <score_int>
set intelligent-analysis-score <score_float>
set malformed-email-score <score_float>
set sender-alignment-score <score_float>
set suspicious-character-score <score_float>
set url-profile <profile_name>
set url-profile-score <score_float>
next
end
next
end
Syntax
|
Variable |
Description |
Default |
|
Enter the name of the weighted-analysis profile. |
|
|
|
Enter a descriptive comment. |
|
|
|
Enter the numerical order of the rule in the profile. |
|
|
| name <rule_name> | Enter a name for the rule. |
|
|
Enable or disable the rule. |
enable |
|
| action <profile_name> | Enter the name of an action profile. |
|
|
Enter the minimum total score that triggers the action. The total score is determined by adding the scores of all categories (suspicious character, etc.) in the weighted analysis rule. |
50.000000 |
|
| action-keyword-score <score_float> | Enter a weight-adjusted score for dictionary profile matches. |
10.000000 |
| cousin-domain-score <score_float> | Enter a weight-adjusted score for domain name impersonation. See also profile cousin-domain. |
10.000000 |
|
Enter the name of a dictionary profile. The dictionary profile contains keywords (for example, "Click here", "Transfer", "Money", "Dollars", "Bank account", etc.) that ask the user to perform an action that typically only spammers ask for, and therefore are suspicious. |
|
|
|
Enter a weight-adjusted score for dictionary profile matches. |
1 |
|
|
Enter a weight-adjusted score for intelligent analysis detections. Multiple factors contribute to and inform the intelligent analysis condition, in order to detect fewer false positive results, including SPF, DKIM, DMARC, alignment of sender addresses in the message header ( |
50.000000 |
|
| malformed-email-score <score_float> |
Enter a weight-adjusted score for malformed emails. Malformed emails are those emails that contain malformed data in the email structure, header, or body. For more information, see RFC 7103. |
10.000000 |
|
Enter a weight-adjusted score for sender domain mismatches. Sender alignment compares the domain name of the sender email address in the message header ( |
10.000000 |
|
|
Enter a weight-adjusted score for suspicious characters. Protects against internationalized domain name (IDN) homograph attacks. If domain names in URLs, sender email addresses, or recipient email addresses have Unicode characters that are from different languages yet look similar (for example, |
10.000000 |
|
|
Enter the name of a URL category profile. |
unrated |
|
| url-profile-score <score_float> | Enter a weight-adjusted score for URL category profile matches. |
10.000000 |