Request for comments 3

[Steve Freegard]

Hi Jules,

Julian Field wrote:
> How about now? It's not in MCP yet, is that a problem? Shouldn't be, as 
> it shouldn't actually make much difference to this functionality (it is 
> working off SA rule names, not scores, so it doesn't matter if other 
> rules fire as well).

Exactly what I was thinking - wouldn't this new method enable MCP-type 
things but without the need for a second SA run (and the rather large 
associated overhead of doing this).

You could simply create the MCP rules and score them as 0.001, then use 
the new feature to quarantine if any of the MCP rule actually fire.

The only thing lacking here is the ability to quarantine the file in the 
mcp quarantine instead of the spam quarantine.  Maybe adding 'store:mcp' 
could be an option to mark the message as MCP and store in the MCP 
quarantine directory???

Kind regards,
Steve.