Incident Responder
Last updated
Was this helpful?
Last updated
Was this helpful?
This section provides a brief description of the Incident Responder. This guide will provide instructions on how to use the Incident Responder platform. The analyses a suspicious email, and according to the results, it takes action at the inbox level. The product also analyses the URLs, IPs, and Files with the engines of different technologies it is integrated where it enables an institution to acquire the technologies that it doesn’t have.
A: No. A single auto-investigation is initiated for identical harmful reported emails, targeting specific malicious elements (Sender IP, Link, Attachment Hash). There is no need to start auto-investigation each time for the same reported harmful email after the first one is started and actively working. The auto-investigation remains active for a day and then expires.
A: No, it does not. No one, including the Company Admins who manage the platform's interface, can view the contents of any email in the inbox.
A: Yes, it is. Many institutions manage the add-in (install, uninstall, enable, disable) with central administration tools, such as Microsoft SCCM, IBM Bigfix.
A: The platform generates a random key which is unique for each customer then encrypts all reported emails on disk with AES 256 algorithm.
A: Yes, you have the feature for an automatic investigation by which and you can detect and remove the suspicious email or any of its variants in any of your users' inboxes, and you can automatically report it.
A: Yes, you have a feature for automatic investigation. With this, you can detect and remove the suspicious email and/or any of its versions in any of your users' inboxes, which you can automatically report.
A: There are no dependencies that is required to download on users computer in order to use Phishing Reporter plugin.
A: This depends on your company policy. If the user has a right to disable it, then it can be disabled. Many organisations handle these processes by GPO.
A: Add-in to connect to the server is through https (default port 443).
Primary use cases for Incident Responder are centered around the following:
I want an incident response system that can automate the technical analysis and investigation of suspicious, malicious emails in under a minute.
I want to integrate Incident Responder with other Threat Intelligence / Sharing and Incident Response solutions already purchased.
I want to make sure that the privacy of users is protected.
I want the service to work on mobile as well as desktop devices.
I want an interface/management console, which can manage each incident.
Incident Responder satisfies the criteria of each of these use cases; please see more below:
Receiving a suspicious email is not great, but with Incident Responder, you’re able to take the right steps to protect your organisation from any malicious attacks from suspected emails and resulting in damaging data breaches. Use the details we know from Phishing Reporter about this discovered Incident and start a New Investigation. This will enable investigators to determine how far the executed attack from the suspicious email has so far penetrated defences by use of filters to ascertain what particular departments or individuals etc., have been affected.
Playbooks are an essential feature of Incident Responder as it automates and initiates investigations without too much oversight from the user. We suggest that you monitor how they are performing and tweak/edit them occasionally to get the best information and results from the investigations.
Incident Analysis is then carried out on the suspicious email within the Incident Response platform as well as other third-party technologies to provide the best results. Act to take the best, effective and quick response to the results and make your organization, colleagues and systems safer, more secure and resilient to prevent the risk of future incidents.
Integrations are commonplace in the information security community, and Incident Responder is no different in being flexible to be used in alliance with other platforms. The New Integration feature walks users through the stages of integrating another cybersecurity solution. Remember to make active the new Integration as the last step to complete Threat Intelligence and Incident Response coverage.
Privacy concerns are of paramount importance in an incident response platform, and Incident Responder addresses these. Both Users and Company Administrators who manage the platform do not have access to the contents of any emails in the users’ inboxes.
The Incident Responder service can be used on both mobile as well as desktop devices.
It is human nature to lose track of what’s going on in a hectic information security environment. Incident Responder mitigates this risk with a comprehensive dashboard which provides an overview into how many users are on the Phishing Reporter platform, Reported Emails, Incidents are undergoing investigation, Top Rules, Incident Analysis and ROI.
It is recommended that you use the Reports generated from the use of the Incident Responder in conjunction with authorised third party technologies to achieve the best results. Reports can be used in line with the organisation’s own procedures and help avert potential cyber threats in the future. Threat Sharing / Threat Intelligence platforms are ideal places in which reported Incidents can be used for the wider benefit of a particular industry or sector.
Yes, it’s possible to integrate with your master (single) tenant via the graph API, then you can restrict the API integration to a distribution group in Azure AD. i.e., you can decide which user mailboxes to integrate with (it does not have to be all of them). Please follow the steps below:
A: Yes, it is possible to integrate any solution. There are many platforms such as DNS Firewall, Sandbox, exploitation tool platforms. . Please view your support page.
A: We analyze suspicious emails by Header, Body and Attachment using our third-party engines integrated into our interface. It is possible to add a new analysis service .
A: Yes, you can use to retrieve reported emails, including Links, Sender IP, and Attachments, and then submit them to Proofpoint via their APIs for analysis.
You need to implement the graph API settings for Incident Responder (following our standard configuration, which includes making the API work for “all’ users - )
Then you need to limit access to the App from Azure AD as it relates to Exchange Online ()