User Manual Part 2

Using VStream Antispam
490 Check Point Safe@Office User Guide
 If the spam score does not exceed the configured confidence level, the
email passes to the next enabled VStream Antispam engine for
processing.
 If the spam score exceeds the configured confidence level, VStream
Antispam determines that the email is spam and handles it as specified by
the IP Reputation engine's settings.
d. VStream Antispam caches the results of the IP Reputation check.
4. VStream Antispam checks whether the email sender appears on the Safe
Sender List. If so, then the email is accepted.
5. If the Block List engine is enabled:
a. VStream Antispam examines the email content and compares the sender
to the list of blocked senders.
b. One of the following things happens:
 If the sender is not on the list of blocked senders, the email passes to the
next enabled VStream Antispam engine for processing.
 If the sender is on the list of blocked senders, VStream Antispam
determines that the email is spam and handles it as specified by the Block
List engine's settings.
By default, VStream Antispam marks the email subject.
6. If the Content Based Antispam engine is enabled:
a. VStream Antispam examines the email content and creates a spam
fingerprint.
b. VStream Antispam sends the fingerprint to a VStream Antispam data
center, where it is checked against an online database of spam messages.
c. The VStream Antispam data center returns a spam score.
d. One of the following things happens:
 If the spam score does not exceed the configured confidence level, the
email is accepted.
 If the spam score exceeds the configured confidence level, VStream
Antispam determines that email is spam and handles it and handles it as
specified by the Content Based Antispam engine's settings.