Message platform for automated threat simulation, reporting, detection, and remediation
摘要
說明書
The operator portal can reconstitute identified messages from the message store for display to a user. As discussed above, the shadow message store stores the parsed components of the messages that it receives. These components are stored in association with each other, for each received message. As such, the system can reconstitute any stored message on demand. In some embodiments, upon execution of a query to the shadow message store, the message store will return the components of messages that match the search query, such that the portal can then reconstitute the messages for display to an operator. For URLs in documents, the operator portal can generate an image of URLs, such that they cannot be readily or accidentally clicked by an operator of the portal.
Quarantine, Delete, and Restore Functions
The operator can cause a command to be issued to the enterprise email server based on the information presented. For example, the portal can issue a command to the enterprise email server to quarantine, move, delete, or otherwise make identified messages unavailable at the user accounts in which that message is found. Correspondingly, the portal can also issue a command to restore, move, or undelete a message. The relevant command can be formed with a message identifier and/or a user mailbox designation. Thus, for example, the operator portal can form a quarantine command by identifying a user mailbox (e.g., by an email address), and a message identifier, and a command, such as delete or move. In some embodiments, the quarantine function can be performed by any means of making a message inaccessible, or less accessible to a user, by e.g., moving it to a hidden folder.
