Configure Phishing Analysis
Table of Contents
Configure Phishing Analysis
Learn how to configure Phishing analysis.
Similar to DLP and Wildfire detections, Data Security supports
Phishing Analysis and detects malicious and phishing URLs
and proactively removes them.
This feature is currently available only for Microsoft
Teams. Data Security scans chat messages, channel messages and URLs
embedded within them.
Phishing Analysis is enabled by default (). You can add URLs to the Whitelisted URLs
(exact URL or domain based) list so that Data Security does not perform
Phishing Analysis on those URLs.
Configure Policies for Phishing Analysis
Data Security uses a predefined Phishing policy
to proactively scan and remediate malicious and phishing URLs. You can also
modify it as per your requirement or create a custom phishing policy using the
following steps.
- Select .Enter the basic information such as policy name, description (optional), severity and enable Phishing Analysis.Select the Cloud Applications (currently only instances of Microsoft Teams) you want to analyze for phishing.Select: URL for Data Pattern or Phishing for Data Profile as match criteria.
![]()
Select the currently available options for Auto Remediation: .![]()
Select Other Actions as required. For example, you can choose to create an incident, assign it to a user, and send an administrator email alert.![]()
Save Policy.Next step: Monitor Phishing Scanning.Monitor Phishing Analysis
You can view the details of assets scanned for phishing. - To monitor phishing scanning, select and apply the appropriate filters.In the following example, you can see that the Phishing data profile filter has been applied to display assets related to phishing analysis.
![]()
Select the data asset you want to monitor to view additional details, specifically Phishing Report.![]()
Data Security uses Auto Remediation to delete malicious and phishing URLs automatically. To delete the URLs manually, select .- If there are two URLs in a chat message, one whitelisted and the other phishing, Data Security performs remediation on the chat message and deletes both the URLs.
- When a phishing URL is detected, only one remediation action can be performed on the asset—User Quarantine OR Delete URL. Both remediation actions cannot be performed on the same asset.
