Informing users about filtered emails

There are not likely to be many firms left nowadays that do not check their users` emails for viruses or spam and block them accordingly. The volume of spam mails has reached such proportions that users would often not be able to deal with them within a suitable time. The question that arises at this point is how to inform users about filtered emails addressed to them. You should definitely not leave them wondering which emails were addressed to them during which period - irrespective of their content. One option is to deliver mails with a warning message inserted in the subject line, another to notify them about every single filtered email - which would not alter the volume of emails, simply their content. A good compromise is to use spam notifications and to send them to all users at regular intervals. You use spam notifications to inform them about emails you have placed in quarantine. The notification does not list deleted emails.

To configure a daily notification of quarantined spam emails for your users, proceed as follows:

• Start by configuring the necessary rights and roles for the user portal and the appropriate quarantine (see April Tips & Tricks) 
• Copy the sample job: Wall - Database jobs - "Default - SPAM Report User"

• Rename the job and edit it as follows:

Basics tab:

• Status: Active
• Start time: Choose a suitable time for sending a notification. Simply adjust the time. If the date is in the past, the job is executed immediately, at the defined time on the following day.
• Interval: The notification should be sent once a day, therefore "1 days"´
• Select quarantine database: Depending on the quarantine in which the spam emails about which you want to inform your users are located, you must select "Standard Quarantine" (g_arch.nsf) or "Extended" at this point. With "Extended" you can select one or more quarantine areas. We assume here that all spam emails have been copied to the g_arch.nsf database.
• Select documents: Here you can use a database quarantine rule to restrict the number of documents that the user will be informed about. The "SpamReportUser" rule confines the notification to emails that the mail jobs have quarantined in the "SPAM" category. If necessary, you can change this rule via the icons under "Edit rules".

Operations tab:

• Simply modify the subject line and the introductory text before and after the table under "Notification", which you configure under "Advanced".
• When the maximum number of emails that can be listed in one notification is exceeded, a text is generated below the table with the variable %JOB::MAXENTRIESTEXT%. The text for this variable is defined in the Notification field on the Advanced tab when it is exceeded and can warn your users that, for instance, not all entries have been listed.

Advanced tab:

• Max. no. of notifications to be sent: Here you can limit the number of users who will receive a notification. A job can send a maximum of 300,000 notifications.
• Max. no. of entries listed in individual notification: A maximum of 100 entries can be listed in each notification email.
• Message issued when this figure is exceeded: Adjust the text if necessary.

The structure of the table in which the quarantined emails are listed is implemented in HTML. You can keep the default settings as supplied by GROUP. Use the Preview button to look at the notification before sending it.

• HTML for table body: The individual listed emails are directly linked to the iQ.Suite User Portal and can be viewed and, if necessary, delivered there. To guarantee smooth access, users must have been assigned the appropriate rights and roles in the user portal or quarantine database! To remove the link to the document and reduce the notification to its basic information, change the expression %FE::HTMLTABLELINK% to %SUBJECT%. This is advisable for notifications that refer to virus documents.

• Define the cases in which the notification should not be sent. Omit the weekend, for example. Spam emails that arrive during this period are added to the Monday morning notification.

• Save and close the job. Around 30 seconds later the database grabber restarts and the job is executed. A few seconds later your users are informed about spam emails that have been quarantined during the last four weeks. After this a new spam notification is generated at 8:00 am each day, listing the emails that the user has not yet been informed of, i.e. those that have been placed in quarantine since the last spam notification was sent.

All users should be informed about all quarantined emails addressed to them, irrespective of sender or contents. There are legal and, possibly, operational reasons for this. However, you don’t want to provide the same information or processing options for all documents. Access to the quarantine database may also slow down because it contains too many documents.

These topics are explained step-by-step in the multiphase anti-spam concept and in conjunction with enterprise-wide quarantine management at our training courses and implemented in practical exercises.

Come and visit us. We look forward to meeting you!