On Jun 4, 2019, at 2:11 PM, Amir Caspi <ceph...@3phase.com> wrote: > > Locally, I've got the score at 4.0, and will be increasing it to 4.5 shortly. > At least with my spamset (per the spamples I posted), a score of 4.5 seems > to be the "magic" value that should catch almost all the FNs (at least the > ones that hit BAYES_50 ... the ones that hit BAYES_00 might require more > aggression).
I'm getting a ton of zero-hour snowshoe spam today that's scoring BAYES_50 and hitting no other rules besides BOGUS_MIME_VERSION. These all score 4.6 with BOGUS_MIME_VERSION = 4.0. I'm going to increase locally to 4.5, and that should get rid of these for me... but I think we should really expedite deployment of this rule for production, I expect I'm not the only one this affects... Cheers. --- Amir
