We have recently implemented ESGs with Hybrid service, but we noticed that a lot of e-mail is coming through marked only as Commercial when it should probably be marked as Spam. Under the Anti-Spam filter, there is the option to edit the Hybrid Service analysis score threshold, but nowhere have I found an explanation as to whether a higher number means more permissive or more restrictive, and against what number this is used-- for example, in the Logs I might see this:
This message was treated as a Clean message;Matched Action-Commercial Bulk Default email hybrid service analysis result: DKIM check is [PASS], spam score is [2.00], name of virus encountered is [NULL], mark message as commercial bulk and reputation score is [19];
Is the Hybrid Analysis number compared with the spam score above? Is a lower Hybrid Service analysis more restrictive or less?