Add negation for forged thunderbird MID in case of maillist.

diff --git a/conf/composites.conf b/conf/composites.conf
index 35c23c3753e453d4bd38c23a33d5714f3a8d1bac..1a0dacb68ece56effdfb9744115cabfd3189d1b2 100644 (file)
--- a/conf/composites.conf
+++ b/conf/composites.conf
@@ -10,7 +10,11 @@ composite {
 }
 composite {
     name = "FORGED_MUA_OUTLOOK_MAILLIST";
-    expression = "FORGED_MUA_OUTLOOK and MAILLIST";
+    expression = "FORGED_MUA_OUTLOOK and -MAILLIST";
+}
+composite {
+    name = "FORGED_MUA_THUNDERBIRD_MSGID_MAILLIST";
+    expression = "(FORGED_MUA_THUNDERBIRD_MSGID orFORGED_MUA_THUNDERBIRD_MSGID_UNKNOWN) and -MAILLIST";
 }
 composite {
     name = "RBL_SPAMHAUS_XBL";

diff --git a/conf/metrics.conf b/conf/metrics.conf
index 75abf37ae5ab07d3d4157396e2f284a4bf75527b..7c48392455ec992cf5f4bcd1200759406768cbdf 100644 (file)
--- a/conf/metrics.conf
+++ b/conf/metrics.conf
@@ -393,6 +393,11 @@ metric {
                description = "Forged mail pretending to be from Mozilla Thunderbird but has forged Message-ID";
                name = "FORGED_MUA_THUNDERBIRD_MSGID";
            }
+           symbol {
+               weight = 0.0;
+               description = "Avoid false positives for FORGED_MUA_THUNDERBIRD_MSGID in maillist";
+               name = "FORGED_MUA_THUNDERBIRD_MSGID_MAILLIST";
+           }
            symbol {
                weight = 2.500000;
                description = "Forged mail pretending to be from Mozilla Thunderbird but has forged Message-ID";