diff --git a/filter-rules.py b/filter-rules.py
index 29c8720..d2812be 100644
--- a/filter-rules.py
+++ b/filter-rules.py
@@ -10,6 +10,7 @@ BLOCK_EMAIL = [
     'diversity@oregonstate.edu',
     'evals@oregonstate.edu',
     'sv_uit_voicemail_cxe@oregonstateuniversity.onmicrosoft.com',
+    'noreply@msexperience.microsoft.com',
 ]
 
 BLOCK_KEYWORDS = [
@@ -134,6 +135,7 @@ ALLOW = [
     'ctptravelservices.com',
     'Travel@concursolutions.com',
     'ghost.io',
+    'orders@catertrax.com',
     'nytdirect@nytimes.com'
 ]
 
@@ -198,6 +200,20 @@ def filter_message(self, message):
             move_message(message, 'zzz-unactionable')
             return
 
+    # filter servicenow email notifications
+    if 'mysupport-replies@oregonstate.edu' in normalized_from:
+        keep = [
+            'opened on your behalf',
+            'your request REQ'
+        ]
+        if is_in_message(keep, message):
+            self._log_result(message, "keeping servicenow message")
+            return
+        else:
+            self._log_result(message, 'moving to servicenow')
+            move_message(message, 'zzz-servicenow')
+            return
+
     # filter unactionable InCommon SSL cert emails
     if 'support@cert-manager.com' in normalized_from:
         actionable = [
@@ -275,14 +291,18 @@ def filter_message(self, message):
         move_message(message, 'zzz-unactionable')
         return
 
-    # delete Atlassian spam
-    if ('confluence@osu.atlassian.net' in normalized_from
-            and '[Confluence] Daily Digest' in message.subject):
-        self._log_result(message, 'deleting atlassian spam')
-        message.delete()
-        return
+    # delete atlassian spam
+    if 'confluence@osu.atlassian.net' in normalized_from:
+        unactionable = [
+            'sv1_ds_atlassian',
+            '[confluence] daily digest',
+        ]
+        if is_in_message(unactionable, message):
+            self._log_result(message, 'deleting atlassian spam')
+            message.delete()
+            return
 
-    # delete Salesforce spam
+    # delete salesforce spam
     if 'salesforce.com' in normalized_from:
         unactionable = [x.lower() for x in [
             'sandbox',
@@ -294,7 +314,7 @@ def filter_message(self, message):
             message.delete()
             return
 
-    # delete Rave junk
+    # delete rave junk
     if ('guardian@getrave.com' in normalized_from
             and 'new guardian chat' in message.subject.lower()):
         self._log_result(message, 'deleting rave spam')