DEFENDER SERVICES

Transcription

1 DEFENDER SERVICES Defender User Guide What does Defender do? Anti-Virus testing to eliminate known and suspected viruses. Blacklist services check distributed lists for fingerprints of known spam. Combined filters eliminate over 90% of known and suspected spam and virus activity. All identified spam and 's containing viruses are stopped before entering your mail stream. We filter more than 450,000 messages per day, speeding through only valid communications. What happens after Defender filters and cleans incoming ? If the is "clean" and does not raise spam flags, it is passed on to the end user. If minor potential spam indicators are indentified, an will be tagged as "spam" in the subject line. o i.e.: [ Defender SPAM suspect] This clean, virus free is passed on to the user throughout the day. o Do not be alarmed if you do not regularly see a "spam" alert - that is how it should be! What do I need to do to make my personal Defender functional? Nothing, unless you wish customize the Defender default settings to enhance your service. Why might I want to look into customizing my personal Defender? To permanently block a sender from cluttering up your box. To permanently add a sender who may normally be tagged as spam (i.e. newsletters). To allow for reviewing of tagged mail in a Pending box rather than in your normal mail stream. READ ON! Those are just a few reasons we find users interested in becoming fully interactive with their Defender User interface. We have provided a fairly comprehensive ~ although not all inclusive ~ user guide below so that those who have an interest in fine tuning their Spam process feel comfortable doing so. User Aide for Secant Defender Version 2008 Access your Defender directly using the following link: Your user name is your corporate address Your password is the same one you use to log into your current service. o Occasionally this is not possible, in which case Secant will provide a user password. Page: 1 of 8

2 Managing your TRAP CONTENTS In the TRAP CONTENTS module you will find your storage for that has been stopped from entering your mail stream and a way to search, correct and review that mail. When Defender receives an for you, it scores the message for its spam probability. This score starts at 0 (definitely not spam) and increases from there based on a series of ratings and tests that are applied. Based on this score, Defender either allows, tags, or blocks the message. Secant only retains blocked incidents with a reasonable spam score (12 or less) as volume permits. After logging into the Defender User Interface, you may select the TRAP CONTENTS tab which provides 3 link options. (When making changes to the options in any section you will want to click Submit Changes before leaving the section to ensure your changes are put into place.) 1. Under PENDING you will: a) Find no entries if you have chosen the tagged method which sends suspicious directly through to your regular mail box with a suspected spam tag. THIS IS THE SECANT DEFAULT SETTING. b) Find that is classified as spam if you have chosen to use the pending messages option. I. You may click on to accept and submit to white list a. Once you accept, please allow 5-10 minutes for mail to route to your in box. II. You may click on to reject and submit to the black list 2. Under SPAM you will find a complete list of the recent mail delivered to your box that has been classified as spam. a) To Accept or Reject a specific sender for future communications: I. Click on the user address (the part before under the SENDER column. Defender User Guide Page: 2 of 8 (rev.2)

3 II. Select the appropriate ACTION from the drop down list, your choices are: a. NO CHANGE allow Secant to continue filtering per normal procedures b. ALWAYS ALLOW remove from Secant spam filter process forever (=White List) c. ALWAYS REJECT block receipt of mail from this sender (=Black List) d. ALWAYS HOLD FOR APPROVAL Tag as suspected spam always e. HOLD if looks like SPAM will be placed in your pending box. f. DELETE from Table remove from the list of retained spam. III. Click Submit Changes to ensure your preference is set for that sender. Please note that when you make a selection in one screen, it may pop you to another module where the change is actually managed before sending you back to your originating area. Select how you want this person's mail handled in the future. b) To Accept or Reject a specific domain for future communications: I. click on the domain address (the part after under the SENDER column II. Select the appropriate ACTION from the drop down list (just as for sender): III. Click Submit Changes to ensure your preference is set for that domain. Page: 3 of 8

4 c) To view the details of the communication before making a determination: I. Click on the DATE of the message to open up details on this spam. When calling Secant for assistance, please provide this "incident number". II. Click Train as spam or Train as non-spam if you would like to train the Bayesian filter. III. Click Thaw if you would like manually reject or accept the message. Once you thaw the message, it will allow the exact same message from that sender to be resent. You will want to call the sender to resend the message if you wish it to appear in your box. **If you are curious and adventurous, this is also the location of the information related to the scoring of the spam in addition to tracking notes for any actions taken to date on that particular . It will look like this: Page: 4 of 8

5 3. Under ADVANCED QUERY you will be able to search current archive of spam classified s in a variety of ways by filling in query filters of your choosing and clicking submit. It will return you a list of items that meat your search criterion from the current stores of spam tied to your account. You may narrow your search or widen it as you choose based upon your entries. Secant will maintain an ongoing reasonable store of your blocked mail (as volume storage permits) with a Bayes score of less than 12 to allow you an opportunity to search for mail that may have tested erroneously as spam. Changing your User Preferences After logging into the Defender User Interface, you may select the PREFERENCES tab which provides 3 link options. Through these modules you may change the way your suspected spam is handled, viewed, stored and delivered. 1. Under PREFERENCES selection you may change: a. Your home page for Defender Interface b. The # of entries you see when viewing trapped mail. c. The sort type and order for messages. d. The method of selecting spam trapping action steps Page: 5 of 8

6 2. Under STREAM SETTING selection you may: a. Raise or lower threshold score on blocked mail (we set default at 5.1) b. Adjust whether mail is simply tagged and sent on or held in TRAP PENDING. i. Tagged mail that is suspected to be spam will be sent to your mail box with a spam tag indicating that it is possible spam. ( Yes selector) ii. Message Hold will keep tagged spam in a PENDING box. (You would retrieve this mail by logging in to the Defender site and review for release those items. No selector.) **Getting too much tagged ? Lower your Spam score value number. Too much of your good mail being tagged? Raise your Spam Threshold number. 3. Under NOTIFICATION you may: a. Select the address where you want notifications of PENDING mail sent (default is your standard corporate address.) i. This section only needed if you choose PENDING notification (NO) over tagged option (YES) under the STREAM SETTINGS options. (S-1200) b. Select the type of notification received. c. Select the time of day and days you would like to be notified if there is spam in PENDING. You will only receive a notification if new pending mail exists. **Please note that Outlook 2007 does not allow for the choice Use Clickable Web Form. Page: 6 of 8

7 Changing your User RULES: Rules refer to the classification of specific senders to ensure proper handling of incoming mail from that source. The two types of groups classified are most commonly referred to as: White list: A list of addresses or domains from which you always wish to receive messages. ** Defender will block an from a white listed sender when the message contains a virus or a disallowed attachment file extension. Black List: A list of senders from whom you never want to receive messages. Defender immediately discards messages from senders on your blacklist. These messages are not tagged or placed in pending and cannot be recovered. The sender does not receive a notice that the message was deleted, and neither do you. After logging into the Defender User Interface, you may select the RULES tab which provides 3 link options. (When making changes to the options in any section you will want to click Submit Changes before leaving the section to ensure your changes are put into place.) 1. Under SENDERS selection you may: a. Enter a senders complete address and classify it to: i. Always Allow : This mail will be checked for virus and then sent right into your box without being tagged as spam. ii. Always Reject : This mail will be rejected as spam without notification or tagging. iii. Hold if Looks Like Spam : This mail will be put through the routine process and tagged as spam if spam scores are met. Page: 7 of 8

8 2. Under DOMAINS selection you may: a. Enter a domain address (only the text following in an address. For When entering a domain address your rules will apply to any mail received from that domain as opposed to specific communications from a specified sender. iv. Always Allow : This mail will be checked for virus and then sent right into your box without being tagged as spam. v. Always Reject : This mail will be rejected as spam without notification or tagging. vi. Hold if Looks Like Spam : This mail will be put through the routine process and tagged as spam if spam scores are met. Tips on specifying addresses If you enter a full address, such as johndoe@yahoo.com, just that user is specified. If you enter just a domain, such as yahoo.com, all users in that domain are specified. If you enter a domain such as secantcorp.com, all sub domains are also included, such as support.secantcorp.com and test.secantcorp.com. Mass mailings often come from domains that do not resemble the company s web site name. For example, you may want to receive mailings from historybookclub.com, but you find that this site sends out its mailing from the domain hbcfyi.com. Examine the from: address of an actual mailing that you are trying to white list or black list to determine what to enter. 3. Under BULK ENTRY you may: a. Enter a list of addresses or domains in a specific manner and apply one set of rules to all of them. Secant recommends that you request assistance when attempting this type of process as a technician may need to verify input to ensure functionality. Your company s network administrator may have rights to access your spam control panel and assist you with searching and releasing s. Secant maintains a fully staffed service desk of professionals who may assist you with any issues you may have accessing or understanding your Eefender. You may contact our service desk through at: helpdesk@secantcorp.com. Please insert DEFENDER as the first word in the subject line. (Telephone: ) Page: 8 of 8