Steven Lamb wrote:
I guess if this is the case I need to lower the score for that rule as my kill value is a 3.5
If you're going to use SARE rules, you probably shouldn't lower your threshold. SARE, like the built-in SA rules, is calibrated for a threshold of 5. If a legit message hits 4.9999, it's perfectly OK because it's been classified correctly. Unless you re-score a bunch of rules, you should expect legit mail to hit in the 3.5-5.0 range from time to time, and likely at a higher rate than you'd see FPs at 5+.
-- Kelson Vibber SpeedGate Communications <www.speed.net>
