Email Watchlist

The Email Watchlist detector collects and normalizes email events from third-party data sources. The events are converted into an alert and assigned a severity and confidence based on the activity observed.

Examples of threat actor techniques using email as an attack vector include:

• Phishing
• Malware attachments
• Malicious URL

Email Watchlist Detector

Requirements

This detector requires the following data sources, integrations, or schemas:

• Proofpoint
• Mimecast

Input(s)

Detections are from the following normalized sources:

• Email

Input Field(s)

Field
sensor_type
status
threats.classification

Outputs

Alerts from this detector are pushed to the XDR Alert Database and Alert Triage Dashboard.

Configuration Options

This detector is enabled by default when the required data sources or integrations are available in the tenant.

MITRE ATT&CK Category

• MITRE Enterprise ATT&CK - Lateral Movement - Internal Spearphishing. For more information, see MITRE Technique T1534.
• MITRE Enterprise ATT&CK - Initial Access - Phishing. For more information, see MITRE Technique T1566.
• MITRE Enterprise ATT&CK - Reconnaissance - Phishing for Information. For more information, see MITRE Technique T1598.

Detector Testing

This detector does not have a supported testing method, though an Advanced Search will verify if alerts originated with this detector.

Note

If no supported testing method is available, an Advanced Search will show you if any alerts came from this detector if a qualifying event was observed. A search with no results does not indicate the detector is not working. A lack of search results for the detector may only indicate that the specific attack has not been observed in the tenant. However, it could indicate the underlying data is not available. Ensure the required schemas are provided in Data Sources along with the supported device type(s) for that schema.

FROM alert WHERE metadata.creator.detector.detector_id='app:event-filter:email'

References

• Schemas
  • Email