I'm trying to implement a very simple rule that looks at the "Received" header(s) and if a string is found apply a negative score. The rule is as follows:
header AH_KNOWBE4 Received=~ /phishtest\.knowbe4\.com/ score AH_KNOWBE4 score -10.0 describe AH_KNOWBE4 Prevents KnowBe4 campaign emails from falling into users Junk folders The rule triggers as expected, but a score of 1 is applied as opposed to the desired -10. What am I doing wrong? Thanks!
