Configure Conversation Tracking
Updated 4 hours ago
by
admin
The Conversation Tracking feature is designed to protect users from impersonation attacks, such as similar external domains, newly observed domains in conversations, and Reply-To email address mismatches by monitoring unusual sender behaviour and alerting users when something looks suspicious.
To configure Conversation Tracking, you can follow the process described below:
- Sign in to the USS dashboard.
- Navigate to Security Modules -> Email Security -> Product Configuration -> Conversation Tracking.
- Adjust the parameters if needed. Please see the parameter description for further information.
- Navigate to the Message Rules and turn on the View System Rules toggle.
- Find the following rules and enable them.
Rule | What it does | Why it is important | Banner message |
Newly Observed Email Address in Conversation | Checks if the external email address is not in the safe list or has never been replied to within the Retention Period. You can allow customers to dismiss banners for specific email addresses by enabling the corresponding settings in the Product Configuration. | Helps users identify that they have never communicated with this specific sender before. While this does not necessarily indicate that the email is harmful, it is advisable to be cautious and review the email's content in such situations. Attackers may create new, uncompromised accounts to send phishing emails or deliver malware. These addresses often aren't recorded in threat intelligence databases and might not be blocked by existing filters. | You have not replied to emails from <external email address> before. Caution required. |
Existing Email Address in Conversation - Low Activity | Checks if the number of replies to an external address is less than or equal to the configured threshold within the Conversation Period. | Helps users understand that they rarely communicate with this email address, which may indicate potential suspicious activity. | You do not often correspond with <external email address>. |
Existing Email Address in Conversation - Regular Activity | Checks if the number of replies to an external address is more than the configured threshold within the Conversation Period. The customer can dismiss the banners for such email addresses. | Helps users recognize that they frequently communicate with this email address, indicating that the sender is trusted. | You frequently correspond with <external email address>. |
Similar External Email Address | Checks if the external email address is similar to the address the recipient has replied to within the Retention Period. | Helps users identify when a sender may be impersonating someone they have previously communicated with. Attackers often rely on subtle changes to appear legitimate, such as replacing letters with similar characters or using slight variations in the email domain. These small differences can be hard to spot. In this way, they try to deceive recipients into sharing sensitive information or clicking on malicious links. | This sender <external email address> is trying to impersonate someone you have emailed recently. This is a high risk. |
Reply-To Address Mismatch | Checks if the sender's email address differs from the Reply-To email address. | Identifies if an email's From address (the visible sender) differs from the Reply-To address (the header that indicates where replies should be sent). While this can be a legitimate practice, such as routing replies to a specific customer service inbox, it can also be a sign of a phishing attempt. Therefore, it is recommended to double-check that the user truly wants to send emails to the specified address. | This sender has a different reply-to address <reply-to email address>, which could indicate an impersonation attempt. Use caution. |