Message platform for automated threat simulation, reporting, detection, and remediation
摘要
說(shuō)明書(shū)
The threat information can also be provided to blocklists and/or blacklists 1820. For example, information relating to certain message addresses, IP addresses, and URLs can be provided. As discussed above, phishing attack messages may include a URL and a suggestion to a recipient to access content at that URL. URLs identified using rules, recipes, or by manual identification can be provided to a network security device, such as a firewall, to enable blocking of those URLs. The URLs may also be provided to a third-party integration for URL analysis. As a non-limiting example, OpenDNS may be integrated with the system to provide URL analysis. In addition to submitting the URL manually to the third-party integration, the user can configure the system to submit any URLs in a report to a third party integration automatically.
As with other integrations, the system allows a user to designate whether or not URLs contained in the report are automatically sent to a third-party integration or not. A user may always manually submit or resubmit a URL to a third-party integration. The system then uses the response from the third-party URL analysis to determine a threat score. Scores are indicated to a user in the Integration Results column of the administrator inbox or administrator recon box, or within a message summary. Results are color coded to provide the user with quick information. A yellow icon indicates that the URL analysis indicated that the URL is suspicious. A red icon indicates that the URL is malicious. In some embodiments, no icon may be provided where there is no threat associated with the result.
