Sometimes a message is modified in transit and loses its fidelity by the time it reaches Symantec. Messages that lose their fidelity cannot be used for custom rules. Loss of fidelity can occur for a variety of reasons.
Determines whether a global rule already exists.
Symantec may create a custom rule even if a global rule already exists as a safeguard in case a global rule is deleted or disabled.
Determines whether the aggressiveness level is met.
If the aggressiveness level is conservative, multiple users must submit the same message before the message is considered for a rule.
If all of the preceding conditions are met, if a spam message is submitted, Symantec creates a new rule. If a false positive message is submitted, no new rule is created, and Symantec might delete the custom rule that resulted in the false positive.