Another strange thing. Appliance reports to be on version 23.3.8 but probably it is on version 23.3.9. There is some mixtures on numbers starting with 23.3.7. If your appliance does not show any updates then you should be on the current version.

Maybe ham reporting and spam reporting is not exactly what you (we) mean. There is no ham or spam feeder similar to Gwava. However you can use white-listing and black-listing.

If you search for SMG tips you will find something like this:  Re-Use Filters, Services and Exceptions and much more ...

This one is interesting too  Full Day Workshop at TTP Asia 2024, Bangalore: Secure Messaging Gateway, Dec 6th 

Dear Diethmar,

it is very confusing also because our services windows looks like this:

And the one from OpenText documentation looks like this:

At least in the "services documentation" here:

https://www.novell.com/documentation/secure-messaging-gateway24.3/secure-messaging-gateway/data/policy_adm_servicees.html

But if we take a look at "Tips and tricks" they somehow and somwhere found a block for "Spam reporting" here:

https://www.novell.com/documentation/secure-messaging-gateway24.3/secure-messaging-gateway/data/t45cyw76z3vn.html

We would like to do the same but can not find an option to show more services or to add unknown.

Kind regards,

Sebastian Novak

I can add another example ...

So it depends a little bit when you have created your edition. We had a lot of discussions around documentation ...

Some small hints for. DKIM service has been added later on. Therefore you miss it in the documentation.

Statistics Recorder has been part of old versions but has been replaced by another way of monitoring. Therefore is is not part of your services. However, my screenshot shows this feature because I started with the very old versions ...

• Coming back to what you really want. Ham and spam:
  Ham: I think you have to go for exceptions and use White List
  i.e. 
  
• Spam: Filters, Black List

Although I do not use "Black List". It is always a problem for me to allow users to block something. Common users do not really know what they are doing.

So if I understand correctly, the only way for user to add spam report is to log in to the SMG and manually add it onto the whitelist. This is a bit unusual and got to say a bit heavy for normal non-technical user to understand. Most of systems have a way to add “report spam” footer in a mail and we kind of expected SMG to have this option.

No, the other way round, Sebastian.

SMG will catch some false positive mails. User will receive a digest. If the administrator allows white lists, the user can tell the system that this combination of "from" and "to" should be white-listed in future. User can enable this feature rather easy by a one-click. Nevertheless, this white-listing does not change the SMG learning curve; it is just a list.
White-listing feeds exceptions.

If you want to use black-listing it works in the contrary way.
Black-listing feeds a filter.

As mentioned above both features do not influence a learning curve. Spam behaviour and so on is outside of SMG and cannot be influenced by us.

I want to add an additional remark. That are my experiences of SMG and it is my understanding of how SMG is working. We have more smart guys in this area who can add some other thoughts and considerations.

The ability to Quarantine a message then allow each user to black/white list a sender sounds like a great idea but it generally doesn't work for me.

In most cases, it is impractical to quarantine every message flagged as spam so the question becomes, "How do you determine what to quarantine?". If you could answer that you would be custom designing your own spam filters.

The issue that is most concerning is when BitDefender incorrectly identifies a needed message as spam. When this happens, the message is blocked and usually not quarantined. The intended recipient must then request a resend and involve the SMG administrator to insure the resent message isn't blocked.

These are not usually isolated incidents: a common false positive are invoices sent by vendors the business deals with on a regular basis. 

• It is impractical to submit samples to OpenText to forward to BitDefender each time this happens.
• It is a waste of the SMG administrator's time to deal with each of these incidents.
• It can be embarrassing to contact a company vendor and ask them to resend a invoice because the spam filter deleted the original. It's even more embarrassing the second or third time.

The only effective way (for a small business) to deal with this issue is to whitelist senders or domains with whom the business corresponds on a regular basis. 

I have provide the end user with a spreadsheet which they maintain and which I can critique. I use it to update, about once a month, the Email Address Exceptions on the Spam and Blacklist filters.

I add some thoughts to Kevin's description.

Many filters offer "sub settings". I.e. Antispam

And you can run filters in a row (see in Tips).

I.e. you can do it in this way: If there is unsecure connection (no SSL or TLS) AND no DKIM AND Antispam thinks it is a "Confirmed Spam" then do this or that. If this mail is really so suspicious then add it to the admin quarantine only. A user will not get a digest for it and a user will not see this entry in the quarantine.

I run several similar "chains" at some customers and they do not want to change it. But it depends on what the customer requests to check.

Sebastian Novak said:

So if I understand correctly, the only way for user to add spam report is to log in to the SMG and manually add it onto the whitelist.

What do you mean by a "spam report"?

SMG can collect and provide statistical information and display it in the form of graphs or tables as part of the Monitoring function. You can collect statistics from specific filters or all the filters in a policy scan configuration then specify which filters are reported on when configuring a monitoring gadget.

Some things to note:

• A filter trigger is reported even if there is an exception that prevents services being invoked.
• You can include in your policy scan configuration a filter with a specific name but having no services nor exceptions associated with it. It will have no impact in the message processing but can be triggered and used to gather statistics.