Configuration Change for Content Filters acting on WBRS Neutral Reputation

Introduction

This document describes the change on the Cisco Email Security Appliance (ESA) to the Web Based Reputation System (WBRS) scoring range associated with URL Filtering for "Suspect", now considered "Neutral."

Requirements

The ESA needs to be running AsyncOS for Email Security version 8.5, or newer, with URL Filtering enabled and a content filter acting on "Suspect" URL scores.  Starting with AsyncOS 9.7 for Email Security, the scoring ranges are re-categorized, and will no longer carry "Suspect".

Change in URL Reputation Scoring

The Cisco Security Application Team has updated the URL Filtering score range previously used for "Suspect" scores of -5.9 to 5.9.  A re-categorized scoring range of "Neutral" now scores reputations of -5.9 to 5.9.  A neutral score does not indicate consideration that a URL or domain would be malicious, or possibly malicious.

URLs that were formerly labeled “Suspicious” are now labeled “Neutral.” Only the labeling has changed; the underlying logic and processing have not changed.

Updated Scoring Ranges

The current scoring ranges for the WBRS system are considered in the following ranges:

Related Information

• Release Notes for AsyncOS 9.7 for Cisco Email Security Appliances
• CSCuv55540: Web Based Reputation Score (WBRS) ranges on ESA needs updating