Re: ALL_TRUSTED Overriding Bayes

2007-05-16 Thread Duane Hill
On Wed, 16 May 2007, Clay Davis wrote: I only have one internal network 10.0.0.0 (mask: 255.255.255.0). I have attached a few of the message that scored like this. Do you have any trusted_networks or internal_networks set up in SA's local.cf? If not, SA would be trying to guess your internal

Re: ALL_TRUSTED Overriding Bayes

2007-05-16 Thread Duane Hill
On Wed, 16 May 2007, Clay Davis wrote: Hi gang: I am getting a bunch of messages that are passing through my SA setup with the following scores: pts rule name description -- -- 0.0 SUBJ_FOR_ONLY Sub

ALL_TRUSTED Overriding Bayes

2007-05-16 Thread Clay Davis
Hi gang: I am getting a bunch of messages that are passing through my SA setup with the following scores: pts rule name description -- -- 0.0 SUBJ_FOR_ONLY Subject contains "For Only" -3.3 ALL_TRUST