Figure 1 depicts the Symantec Brightmail architecture.
When Symantec Security Response receives spam from email probes, operators immediately create appropriate spam filtering rules, which are downloaded to Symantec Brightmail customer machines.
Similarly, Symantec Security Response sends realtime virus rules.
These rules are used by customer’s Symantec Brightmail servers to catch spam and viruses.
After the mail (1a) or (1b) is received by the MTA, the MTA sends a copy of the message contents to the Symantec Brightmail server (2).
The Symantec Brightmail server uses its rules and data to determine if the message is a spam or virus (3), and returns a verdict to the MTA.