False Positive and False Negative Reporting

Situation	You are receiving clean email being marked as spam or spam email being marked as clean and want to report it to Excel Micro support.
Solution	Report emails to Excel Micro Support so that we can alert Proofpoint and have spam definitions updated. See below to learn more about False Positives, False Negatives and how to report them.

 

False Positive (FP): message that is not spam, but incorrectly being blocked as spam. 

These messages could be inbound or outbound. When an outbound message is quarantined, depending on the set-up, either the user and/or admin will be notified.  The Support Team will need a copy of the original message being sent. Without this original message, we cannot assist you in sending or receiving this message we will be unable to adjust our anti-spam service for this FP message issue. 

False Negative (FN):  message that is spam, but is incorrectly seen as a regular email. 

Incoming False negatives are messages that come through our system that passed our anti-spam filtering. This is an annoyance to end-users and should be reported to ensure that the message(s) are not seen again. Again, support will need a copy of the original message.

 

Reporting FP/FN as an admin (only Admins can see this option):

As the admin, please follow the below instructions:

1. Click Log Search.
2. Search for the message.
3. Under Actions, click Detail (FN/View (FP)).
4. Copy the permalink at the top.

   Note: You will need to provide this to support when you report this message.

5. Click Report as false negative OR false positive.
6. Fill out the information on the next page.
7. Check the box, allowing Proofpoint Essentials access to the message.
8. Click Report.
9. If you have multiple, please repeat the above.

Warning: If you are using the drop down selection to 'report as..' you can only do this one at a time, you cannot mass select messages and report. This does not work.

Certain messages can not be reported: messages that triggered custom filters or sender lists, and messages that were sent to a non-licensed email address

Warning: Do not use "Classify as..."

In the drop down, in step 5 we indicate to use the 'Report as...'. This allows Proofpoint Essentials support to retrieve the message. If you use the 'Classify as' option, it will not allow us to retrieve the message.

Update Time

Our team that reviews the spam definitions processes these as they come in. It does take time to review all of these. Some are automated, some are manual. With the automation side, it can be a quick small update, or it could be a machine learning process where it has to go through several iterations of training. This process time can take a couple of days in some cases before an update is available. 

However, once a definition is ready, typically the servers all update within an hour after they push the update.