This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[SFOS 18.5MR3] Poor spam detection after update to Sophos Anti-Spam Interface

Hi everyone,
I am setting up a separate thread as I did not receive any specific reply in other threads.

The case concerns Sophos Anti-Spam Interface after upgrading from v18.5MR2 to v18.5MR3 and from v19EAP1 to v19EAP2.

Before updating, antispam works great in legacy mode, detects a lot of intrusive messages and tags with a prefix (near 99%). After updating, only some messages are detected as spam and tagged (I did not do any changes in configuration).

What it comes from? How can I edit my lists to achieve pre-update spam detection?

Greetings

This thread was automatically locked due to age.

Top Replies

Karlos over 2 years ago in reply to Bart van der Horst +3 suggested

Just to update this thread, RE: NC-90702, development will include a fix in SFOS 18.5 MR4 and 19.0 MR1.

Parents

0 LuCar Toni over 2 years ago

I am curious.

Are only Home Users seeing this issue? Because it looks like, only Home Appliance are affected by this potential issue. Or does somebody with a Appliance (SG/XG/XGS) have the same issue?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 Bart van der Horst over 2 years ago in reply to LuCar Toni

Hi LuCar Toni,

I've got a few customers upgraded to MR3, one off them has this problem and so am I with my LAB/Home version. Customer is xg210 with paid license. The thing that's the same is we both do IPv6 on the in and outside.

Opened case Nr: 05143473

Bart.

Bart van der Horst

Sophos XG v18-v21 Certified Architect
Cancel
Vote Up 0 Vote Down

Cancel
0 DejanBukovec over 2 years ago in reply to Karlos

Hi Karlos Yes we use MTA mode(From beginning when it has been implemented in XG) :

Do I need write something "special" in new ticket or just mention that we have patch NC-90702 and NC-94529 and still receiving phishing emails...

All received emails are scanned but score is to low(Around 10%)... I report all mails to sophos lab...
Cancel
Vote Up 0 Vote Down

Cancel
0 RedTunnel97 over 2 years ago in reply to DejanBukovec

Hi,

im having this issue too, on v19 in MTA mode hotfixes are installed automatically.

Restarting services via service antispam:restart -ds nosync doesn't fix the issue.

My /log/sasi.log is full of range ckeck errors: DNS/Request.cpp:246] vector::_M_range_check

Same as DejanBukovecmy X-SASI-SpamProbability is all around 10%

any suggestions?
Cancel
Vote Up 0 Vote Down

Cancel
0 Karlos over 2 years ago in reply to DejanBukovec

Yes, please mention that you have received both patches and that you are on MTA mode and you have already been submitting SPAM samples to labs. Once opened, please provide the Support ID. Thank you.

Karlos
Community Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Karlos over 2 years ago in reply to RedTunnel97

Hi RedTunnel97, could you also confirm that your anti-spam pattern update was last updated less than 2 weeks ago?

Karlos
Community Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 RedTunnel97 over 2 years ago in reply to Karlos

Hi Karlos i can confirm the AntiSpam Version 10.219 from 21.06.2022 is installed, and still receiving lots of spammails
Cancel
Vote Up 0 Vote Down

Cancel
0 Karlos over 2 years ago in reply to RedTunnel97

Do you have an open Support case? Have you submitted false negative samples to our Labs?

Karlos
Community Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 DejanBukovec over 2 years ago in reply to Karlos

Hi Karlos I have open new case with id 05451603
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 2 years ago in reply to DejanBukovec

there is a new version from 1st july which appears to have reduced my junk email, but not all.

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Thomas_XG over 2 years ago in reply to rfcat_vk

Hi Ian,

how is the spam recognition at the moment?

_______________________________________________________

Sophos SG 210 with Sophos XG Home - 20.0 MR 1

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 2 years ago in reply to Thomas_XG

No, I was wrong, the spam is getting through, my mail rules have identified it as spam and mail on mac mini rule moves it to junk folder.

I am waiting for v19.0.1 mr-1 before asking questions about processing on the XG.

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 rfcat_vk over 2 years ago in reply to Thomas_XG

No, I was wrong, the spam is getting through, my mail rules have identified it as spam and mail on mac mini rule moves it to junk folder.

I am waiting for v19.0.1 mr-1 before asking questions about processing on the XG.

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data