SaaS Security
Configure Phishing Analysis
Table of Contents
Configure Phishing Analysis
Learn how to configure Phishing analysis.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
Or any of the following licenses that include the Data Security license:
|
Similar to Enterprise DLP and Wildfire detections,
Data Security supports Phishing Analysis and
detects malicious and phishing URLs and proactively removes them.
This feature is currently available only for Microsoft
Teams. Data Security scans chat messages, channel messages and URLs
embedded within them.
Phishing Analysis is enabled by default (). You can add URLs to the Whitelisted URLs
(exact URL or domain based) list so that Data Security does not perform
Phishing Analysis on those URLs.
Configure Policies for Phishing Analysis
Data Security uses a predefined Phishing policy
to proactively scan and remediate malicious and phishing URLs. You can also
modify it as per your requirement or create a custom phishing policy using the
following steps.
- Select .
- Enter the basic information such as policy name, description (optional), severity and enable Phishing Analysis.
- Select the Cloud Applications (currently only instances of Microsoft Teams) you want to analyze for phishing.
- Select the currently available options for Auto Remediation: .
- Select Other Actions as required. For example, you can choose to create an incident, assign it to a user, and send an administrator email alert.
- Save Policy.
- Next step:Monitor Phishing Scanning.
Monitor Phishing Analysis
- To monitor phishing scanning, select and apply the appropriate filters.In the following example, you can see that the Phishing data profile filter has been applied to display assets related to phishing analysis.
- Select the data asset you want to monitor to view additional details, specifically Phishing Report.
- Data Security uses Auto Remediation to delete malicious and phishing URLs automatically. To delete the URLs manually, select .
- If there are two URLs in a chat message, one whitelisted and the other phishing, Data Security performs remediation on the chat message and deletes both the URLs.
- When a phishing URL is detected, only one remediation action can be performed on the asset—User Quarantine OR Delete URL. Both remediation actions cannot be performed on the same asset.
