Granular Rule Name Statistics

[utkonos]

Is there a location in the database where statistics that are granular to the spam rule name are tracked?

I am looking to determine if there are some rules which can have nuclear custom scores put on them so that they become hard block rules, but I want to determine if any of these rules are being detected in delivered (non quarantined and/or whitelisted) emails.

For example, given a rule "FOOBAR". I want to understand at what frequency this rule is triggered on emails that do not meet a quarantine threshold and are therefore delivered or were delivered due to meeting a whitelist criteria earlier in the rule stack.

Put in a different way, I'd like to know the statistics of "FOOBAR" rule in an email that was actioned by Accept, Block, and Quarantine.

I think I can get there via log parsing, but if this is already tracked in a database, that would make it easier.

 

[utkonos]

Looking at this from another direction: by binning all rules into how frequently they occur in emails by Accept, Block, and Quarantine could also reveal whether there are any non-obvious rules that only occur in Block/Quarantine and never end up in Accept. Those could then be hard blocked.