Configuring heuristic options
The FortiMail unit includes rules used by the heuristic filter. Each rule has an individual score used to calculate the total score for an email. A threshold for the heuristic filter is set for each antispam profile. To determine if an email is spam, the heuristic filter examines an email message and adds the score for each rule that applies to get a total score for that email. For example, if the subject line of an email contains “As seen on national TV!”, it might match a heuristic rule that increases the heuristic scan score towards the threshold.
• Email is spam if the total score equals or exceeds the threshold.
• Email is not spam if the total score is less than the threshold.
The FortiMail unit comes with a default heuristic rule set. To ensure that the most up-to-date spam methods are included in the percentage of rules used to calculate the score, update your FortiGuard Antispam packages regularly. See
“Configuring FortiGuard updates and antispam queries”.
To configure heuristic scan options
1. When configuring an antispam profile, enable Heuristic in the AntiSpam Profile dialog.
2. Click the arrow to expand Heuristic.
3. From Action, select the action profile that you want the FortiMail unit to use if the heuristic scan finds spam email.
4. In Threshold, enter the score at which the FortiMail unit considers an email to be spam. The default value is recommended.
5. In the The percentage of rules used field, enter the percentage of the total number of heuristic rules to use to calculate the heuristic score for an email message.
6. Continue to the next section, or click Create or OK to save the antispam profile.
| Heuristic scanning is resource intensive. If spam detection rates are acceptable without heuristic scanning, consider disabling it or limiting its application to policies for problematic hosts. |