"Michael Scheidell" <scheid...@secnap.net> wrote in message news:c5cb212a.81f45%scheid...@secnap.net... >> Is there any rulesets or plugins that will let me make a word list >> that if there are 2 or more of the words in the list I can start to >> assign a score. >> > Yes, use meta rules > > Header or body rule, header example, lets say that if we see any of these > two words in the subject line, block it: > > Bob > Steve > Henry > > header __BOB Subject =~ /Bob/ > header __STEVE Subject =~ /Steve/ > header __HENRY Subject =~ /Henry/ > > meta ((__BOB+ __STEVE+ __HENRY) > 2) > > > -- > Michael Scheidell, CTO >>|SECNAP Network Security > Finalist 2009 Network Products Guide Hot Companies > FreeBSD SpamAssassin Ports maintainer >
Hi Michael, I suspect you meant to write it as this: meta ((__BOB+ __STEVE+ __HENRY) > 1) Your version ends with >2 (greater than two), which means three or more - so the meta will only fire if all three names are present. If you just want to hit on any two of the three names, then use >1 (greater than one), ie. two or more. :) Cheers, Jeremy
