| Email Security Products |
|
GEE Whiz 2.1 Best Practices
Q: I am getting ready to use GEE Whiz for the first time. Where do I start?
A: When you set up a trial version of GEE Whiz for the first time, we recommend you limit the number of users who are affected by your trial by turning on the "Enable Spam-Control Apply List". When you select the "Enable GEE Whiz Spam-Control ONLY on these addresses", you control which accounts are going to be spam filtered by GEE Whiz. This way, only the users in the Apply List will have their emails modified. The rest of the users will not notice any difference in how their mail is treated. You can set a Global Apply List in the General Tab, or you can create individual Apply Lists for each of the Anti-virus, Spam Control and Attachment Blocking sections. The Global Apply List overrides the individual category settings.
Q: What identifiers does GEE Whiz use to mark an email as being SPAM?
A: We recommend you leave the default subject modification for all emails identified as spam to use *Sb* S-P-A-M *Sc* as the identifier. When you start using GEE Whiz, you might also want to modify the Non-Spam Identifier to be *Sb* *Sc*. This will allow you to identify Spam for your users but it will also identify the Spam score for all emails. This will provide you with the opportunity to determine what the best Spam theshold will be for your environment. After you are comfortable with the levels, this can be easily changed to *Sb* in the GEE Whiz web administration portal.
Q: What options do I have to see the SPAM header information?
A: By selecting the options to "Add Spam Headers To Message" and to "Attach Spam Results To Message" without selecting the "Only on Messages Found As Spam", the Spam ratings for all emails will be attached to all emails. This will help you determine if there are rules for which you want to change the weighting. Changing the GAS weightings is an advanced function that can be implemented later on.
Q: What are "Default Bayesian Tokens?"
A: We strongly recommend you implement the Bayesian Classifier Filtering option with the Default Bayesian tokens until you have established your own customised libraries of SPAM (bad emails) and HAM (good emails). This will allow you to take advantage of the most sophisticated Spam detection algorithm and heuristics that are available in today's world of spam detection. For more information on Bayesian Classifier Filtering, go to www.paulgraham.com. For information on how to implement Bayesian Classifier Filtering with GEE Whiz, please select the "Enable Bayesian Classifier" link in the GEE Whiz Administration Interface. Bayesian Classifier Filtering allows you to "teach" your system what is SPAM and what is HAM based on the emails that are received by your company. The advantage of Bayesian Filtering is that it allows you to define SPAM and HAM based on the email that is specific to your company. If your company is in the entertainment or travel business, your HAM/SPAM email will be much different that if you are in the healthcare or legal industries. Bayesian filtering allows your SPAM detection to be customised - based on the definition of SPAM/HAM emails that are important to your company.
Q: How can make it easy for our users to differentiate SPAM from regular mail?
A: We suggest that you create a folder off root in each of your users' GroupWise accounts called "SPAM" and create a rule that moves any emails that contain S-P-A-M in the subject to this folder. If you are using GroupWise 6.5 with the 6.5 client, we recommend you move the spam to the Junk Mail folder. (Applying this rule can be done automatically with our CRU for GEE Whiz tool after you buy GEE Whiz.) By moving the spam into a separate SPAM or JUNK MAIL folder, spam mail is separated from regular mail for your users. More importantly, it allows your users to ensure that what GEE Whiz has identified as spam is actually spam and not a "false positive". A "false positive" is mail that is desired by the user that GEE Whiz has identified as spam. False positives usually fall into what we call an "intermediate" threshold and are best monitored by the end user. Using this strategy significantly decreases the amount of work that you will have to do as an administrator.
Q: What are the recommended SPAM thresholds?
A: Following are the recommended SPAM thresholds:
0 - 3.4 (4.0 if implementing Bayesian) Do not identify as Spam. Do not modify the subject, but append the spam score to the end of the email. Allow this mail to be delivered to the user without being tagged. 3.5 - 6 (4.1-7.0 if implementing Bayesian) Mark as Spam, append the identifier S-P-A-M and the score to the subject. Emails at this level of intermediate threshold usually fall into the category of potential "false positives". Customer feedback has proven that allowing end users to manage this intermediate level is by far the best way to manage the negative impact of potential false positives. 6.1 - 11 (7.1-12 if implementing Bayesian) Forward to a spam@yourdomain.com account. You might NOT want to implement this option immediately or you might want to make this number a higher range. A higher range will allow your users to receive more of the mail. This will give them a better understanding of just how much Spam they recieve. A lower range will decrease the amount of mail that goes to the user. Chances are that you will adjust the starting level to a lower value over time. You can then check this account from time to time to see if there are email addresses that should be added to your While List. 12+ (13+ if implementing Bayesian) Auto-Delete. (You might NOT want to implement an auto-delete threshold when you first start out. This will give you a better feeling for some of the types of Spam that arrives that have a high rating. The best thing during a trial might be to set the "forward" range to be from 6 to 99 and not use an auto-delete theshold. After you have tweaked the values based on feedback from your test group, you will have a much better idea of values that are appropriate for your environment. These strategies will allow you to start using GEE Whiz with the least amount of interruption for your users. |