Learning (Bayes)

The Bayesian filter learns what your organizations' spam and legitimate mail look like from words, link domains, senders, attachment types and mailer software.

How it learns

• Reports - "Report spam" / "Not spam" on a message page, the Quarantine bulk buttons, and users' portal reports. A report trains the organization's corpus and the shared global corpus.
• Auto-learning (organization corpus only, never viruses or outbound mail):
  • Spam: the message ends quarantined or rejected, and either scored 15 or more or the AI called it spam, phishing, BEC, a scam or malware with at least 85% confidence.
  • Ham: the message is delivered as clean, and either the AI called it clean with at least 85% confidence, or it scored 1.0 or less and the sender passed DMARC (so a forged sender cannot teach the filter).
  • Mail held for AI review learns once the model has ruled. When the AI and the outcome disagree, nothing is learned.
  Thresholds: bayes.autolearn_spam_score, bayes.autolearn_ham_score, bayes.autolearn_ai_confidence. Switch off in Settings › Bayesian learning.
• Training needs the raw message, so reports only work while a raw copy is retained.
• Reporting the same message again with the opposite label flips it (the old counts are removed).

How it scores

An organization's own counts weigh twice as much as the global corpus, so one client's newsletters don't look like spam to another. Probabilities become rules BAYES_00 to BAYES_99 - see the rule reference.

The Learning page (Protect › Learning)

Corpus

"Global (shared)" plus one row per organization that has trained mail.

Spam / Ham trained

Messages learned of each kind.

Tokens

Distinct features stored.

Status

learning with a progress bar until both counts reach the minimum (50 by default); then active and Bayes starts scoring.