EXCHANGE ONLINE PROTECTION SPAM OVERVIEW. Tech Tips, Tricks and Tools by MessageOps

Transcription

1 EXCHANGE ONLINE PROTECTION SPAM OVERVIEW Tech Tips, Tricks and Tools by MessageOps

2 TABLE OF CONTENTS: OVERVIEW AND DOCUMENT INTENTION..3 TRANSPORT RULES CONTENT FILTER MALWARE FILTER HOSTED QUARANTINE CONNECTION FILTER BEST PRACTICES....20

3 OVERVIEW AND DOCUMENT INTENTION This document is designed to provide an in-depth look at the Exchange Online Protection (EOP) filtering service that is provided for the Exchange Online service within Office 365. After reading this document, you will know how to do the following: 1.Create and manage Transport Rules 2.Apply content filtering settings 3.Update and control malware notifications 4.Setup and configure the quarantine service in Office Understand the Connection Filter 6.Learn some Best Practices Tips Within this document, you will find links to expand on the topics covered, as well as examples which help outline and better explain the functions within EOP. This document is not designed to be an All-In-One resource for EOP, but to provide fundamental understanding and to arm you with the knowledge you will need to build a successful filtering solution with Exchange Online Protection. This document also assumes you have a basic understanding of the Exchange Administration Center within Office 365. You have logged into the Office 365 Portal, have navigated through the Exchange Admin Center, and are ready to begin understanding mail flow and spam settings within Office 365.

4 TRANSPORT RULES Transport Rules within Office 365 is the definitive way to control the fundamentals of flow. They provide an amazing level of functionality, from customizing headers and footers for s, scanning s for key words for incidents, redirecting specific s for specialized connectors, and creating a robust level of availability for your departments. Transport Rules are broken down into Conditions and Actions. When the rule does perform its action, it is based upon the conditions specified for it. Multiple conditions are treated with the AND operator, so including multiples will mean the has to match all conditions. The Transport Rules are organization wide. That is to say, they are processed when an is accepted by Exchange Online and before they are delivered to a mailbox. This is also something to keep in mind, for example, you cannot create a Transport Rule to whitelist an IP Address if the IP Address is blacklisted. Why? The connection from the IP Address is refused, therefore the is never accepted and a Transport Rule has no object upon which it can perform its action. Understanding Transport Rules are critical to managing mail flow for Office 365, and when it comes to Exchange Online Protection, Transport Rules are one of your main weapons in the battle against SPAM.

5 TRANSPORT RULES Let s take a look at creating a Transport Rule now: Rules are located in the Exchange Admin Center Mail Flow Rules At the top of this bar, you ll find a few various options: Here, we have our transport rules. You can see that it lists our transport rules in order of priority, as well as some options at the top. The options and their descriptions are as follows: New Transport Rule (+): Here you can create a new Transport Rule and choose to select a few pre-defined templates. Edit Rule (Edit Pen): Allows you to edit the current highlighted rule Copy (Double Pages): Copy the Transport Rule Delete Rule (Trash Can): Deletes the highlighted Transport Rules Priority Change (Up/Down Arrows): Moves the selected Transport Rule(s) up/down in the priority list. Reports (Graph Icon): Generates a report of mail flow which has been qualified for the selected rule. Refresh (Double Circling Arrows): Refreshes the current list of transport rules

6 TRANSPORT RULES Most of these are pretty self-explanatory. The Reports function is nice as it builds a report for you on sent or received mail for that given rule and displays it in a new window in the browser. Let s create a Transport Rule now. Clicking the new transport rule button (+) will bring up a new window:

7 TRANSPORT RULES From here, we can give the transport rule a name and start selecting its Conditions and Actions. By default, the window does not display all possible options when creating transport rules. This is an attempt to give you the most common transport rule features, without cluttering the interface. Selecting More Options down at the bottom of the Transport Rule Wizard will enable all Actions/Conditions, as well as display more auditing information. Let s do this now:

8 TRANSPORT RULES The Conditions/Actions have been updated to include more options; selecting a date range for the rule to work, leaving a comment, and the ability to stop processing more rules, match sender address in the header, envelope or either/or. Let s create a rule now. We have the need in the organization to block s from a given domain, Contoso.com. Members of the Contoso.com domain have been ing solicitous s to our users, and we want all s from this domain to stop as we have no legitimate business needs with this domain. Our end result is to have all s from this domain be deleted and a notification sent to an administrator shared mailbox designed for receiving alerts. We will give our Transport Rule a name, e.g. Block Contoso.com Messages. Next, we will add a condition: If the sender s domain is. From here, we add contoso.com to the list, press the + sign to add it to the list, and then hit OK to save the condition. Next, we are going to define the actions: Delete the message without notifying anyone and Generate an incident report and send it to. The reason for this is that we want to delete the message, but we also want to send a notification to a Shared Mailbox we have created so that we have an ongoing record of s sent from the domain. We have created a Shared mailbox, which does not consume a license, called Shared1 for this purpose. The Incident Report Generation from this action allows us to not only have the original , but also have some additional information about the to be sent to the listed recipient.

9 TRANSPORT RULES Now, if we wanted to specify any exclusions to this rule, we can add an Exception. We ll add an Exception now for Bob from Contoso.com, as he is someone we do trust to send s. Now, we want this rule to run all of the time, so we will not set a date range. We also do not want any other Transport Rules to interfere with this rule. This should come into Exchange Online, be caught by this Transport Rule, and not have the possibility of being affected by other rules it may condition for. Therefore, we select the Option to Stop processing more rules. This means no more Transport Rules will be applied if their scope includes this . This can be critical where a Transport Rule may overlap another rule.

10 TRANSPORT RULES For instance, I may have a rule after this rule that states to redirect messages containing.zip files to hosted quarantine. For s from contoso.com, even if they have.zips, I want them to be blocked and the incident report to go to my shared mailbox, where it will stay. The option to stop processing more rules ensures no other rules down the priority list will enact their action. Lastly, I can choose to match sender address from the Header or the Envelope sender. The header sender matches the FROM: address in the , while the envelope sender denotes the reply-to address for returns. Also, we can choose to leave a comment.

11 TRANSPORT RULES When creating Transport Rules, we should understand that the priority should be treated as an escalation path for s. Our general rules like Disclaimers should be at the top of the priority list, as we state we want these types of actions to apply to all s. When we start to drill down into some of the spam actions, we would want them to act on top of each other. Here is a good example: 1.Transport Rule #1 sends suspicious s from contoso.com to Junk Folder 2.Transport Rule #2 sends s with.zip files to hosted quarantine. a.therefore, if an from contoso.com comes in, AND it has a.zip file, it will be routed to Hosted quarantine, and not just not the junk folder 3.Transport Rule #3: If the contains malware, immediately delete the message and notify the Administrator a.now, if that same with the.zip file has malware detected in it, transport rule #3 steps in and deletes the . We would want all of the Transport Rules to work together like this. Work together and in tandem, a logical stack of escalating actions. There are many conditions and actions for the Transport Rules, and it would be difficult to get into all of them. However, keep in mind how they work, and how Transport Rules can be critical to managing mail flow.

12 CONTENT FILTER The content filter in Exchange Online is used to analyze the body of an , identify possible spam conditions, and apply a spam action to the . An Exchange Online organization can have many content filters, all looking for different conditions and each applying their own actions. The difference between Transport Rules and Content Filter is that the Content Filter has a few actions which are specific to it and controlling SPAM. The Content Filter is located in the EAC Protection Content Filter Content Filters all have 3 parts: 1.Action: What should the Content Filter do with the s that it is conditioned to find? Send them to Junk? Hosted quarantine? Redirect to another user? Redirect to Junk Folder is the default 2.International Spam : s can be scoped for written in a language or sent from a specific country 3.Advanced Options: These contain options for blocking messages from bulk senders, SPF failures, embedded object tags in HTML, etc.

13 CONTENT FILTER The Content Filters look mostly at the body of the . What is in the that can be listed for spam? Doesn t really look at sender domains (Other than to do SPF/Sender validation) and doesn t care about the server that sent the . Instead, it is more concerned with the content of the . Content Filters should also follow logical progression for escalation. Here is an example: Content Filter #1 is scoped for s sent in Italian. If any is received and it is in Italian, it is considered Junk. Content Filter #2 is scoped for SPF failure and its action is to send to quarantine. If an comes in and it is in Italian, AND it has an SPF failure, it will be send to the Hosted Quarantine, instead of just being routed to the user s Junk folder. The Content Filter can also be used to send Quarantine Notifications to s. This is done by selecting the Configure End-User Spam Notifications:

14 CONTENT FILTER If the Content Filter is scoped to send items to the Hosted Quarantine, you can configure it to automatically notify users when an sent to them is instead redirected to Hosted Quarantine. You can have this be sent out within the length of time specified, 1-7 days. Keep in mind that only s caught by the Content Filter and send to quarantine this way will generate the end user spam notifications. s sent to hosted quarantine from a Transport Rule cannot be setup to generate an end user notification. You can generate a notification, but it is to a specific recipient, and not dynamically to the recipient.

15 MALWARE FILTER The Malware Filter in Exchange online is always active. It scans all s inbound and outbound. s at rest are not actively scanned, but anytime an enters or exits the system, it will be scanned for malware. The Malware Filter uses 3 heuristic engines which are updated every 15 minutes or sooner. The Malware Filter does not have a lot of customization to it. You can choose to customize the following: 1.Attachment Action: a.delete Entire Message b.delete All Attachments with Default Alert c.delete All Attachments with Custom Alert 2.Notifications: a.notify Internal Senders b.notify External Senders 3.Admin Notification 4.Customize the Notifications for Custom Alerts: a.from Name/ b.subject c.message to be sent

16 MALWARE FILTER

17 HOSTED QUARANTINE The Hosted Quarantine Service in Office 365 offers a place to hold s that have been deemed unsafe or suspicious. By default, nothing routes to Hosted Quarantine. Transport Rules and Content Filters must be configured with Quarantine Actions for s to start filtering into this service. The hosted Quarantine is located in the EAC Protection Quarantine. It is Microsoft s recommendation to use the Junk Folder in the users mailbox to handle non-threatening spam. It exists for a reason, and it is possible that false positives do happen. Users have the ability to manage their own personal/block lists specific to their mailboxes. If s come into the junk folder, they have the option themselves to whitelist that particular sender or domain. Most junk should be handled this way, as it saves time for the administrator from having to analyze every that comes in that gets marked as Junk.

18 HOSTED QUARANTINE Administrators can choose to delete or release the back to the user, or another recipient, from the hosted quarantine console. Following our escalating logic path, s that contain items or users we do not trust should end up here (.ZIP attachments are classic examples). Perhaps, you want to analyze every.zip that comes into the organization and release accordingly. Routing the.zips to the hosted quarantine will help you achieve this goal. Normally, users cannot access the Hosted Quarantine service themselves, as it requires setting up RBAC, educating the user, and allowing them access to all quarantine messages. A better alternative is the end user spam notification s, however this carries the limitation that it is only for s caught by the Content Filter, and not by the Transport Rules. At this time, the Content Filter cannot be scoped against.zip attachments.

19 CONNECTION FILTER The Connection Filter in Exchange Online is used to filter s based on IP addresses. It is important to understand that Exchange Online Protections blocks roughly over 85% of all spam based on IP Address. That is to say, that out of all of the s Exchange Online handles, 85% of it is spam that never even makes it past the IP connection stage. As stated earlier, it s important to understand where the Connection Filter comes in to play. The IP address is one of the first things looked at for determining possible Spam. If we have an IP Address that may be listed as spam, or is showing up on Spamhaus blacklists, we may need to forcibly whitelist that IP Address so that our O365 Company can accept for the IP Address. Creating an allow Transport Rule for an IP Address does not necessarily work, as the may never be accepted for a Transport Rule to act upon, as it never makes it past the IP connection. IPs here can be whitelisted or blacklisted, depending on the company needs.

20 BEST PRACTICES The following are considered Best Practices. There is no offer of warranty or guarantee for the results that may result from you using these methods, however, they are straight forward and easy to understand, so you should be able to adopt them to match your own. Transport Rules: Remember to create a path of escalation for s when it comes to dealing with spam and malicious content. Regular s that are considered safe, but an annoyance to the user due to their spam nature, should be routed to the user s junk folder for further determination. s considered harmful should be routed to Quarantine or another recipient mailbox. Letting the end user decide what to do with a.zip file may be too risky, especially if some of your recipients have access to sensitive data. Sending to hosted quarantine gives the administrator the first chance to review the , and if appropriate, release it to the user.

21 BEST PRACTICES Connection Filter: These should be used sparingly, especially in the world of shared/hosted services who may be sharing one IP address. A good rule of thumb is if you whitelist an IP address via the connection filter, you should create a transport rule to cover it. e.g. Condition: if was received from IP address , Action: redirect the message to quarantine, Exception: except if the sender s domain contains Fabrikam.com. Content Filter: A good practice is to use the SPF failure. A domain that fails SPF is certainly not in the right configuration state at best and should review their ing practices. At the minimum, you should route these to Junk where they can be reviewed by the end user. If it fails SPF and it contains malicious content or attachments, it should be considered to be sent to the hosted quarantine.