Cisco Secure Email Threat Defense high number of threat emails sent by an internal user
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal:
Detects when a high volume of threat emails are sent by an internal user.
Strategy:
This rule monitors emails to detect multiple threat emails sent by an internal user. This includes the mail sent within your Microsoft 365 tenant or mail sent to recipients outside of your Microsoft 365 tenant.
Triage & Response:
- Investigate suspicious emails sent from the user
{{@fromAddress}}. - Identify the internal user(s) responsible for sending the threat emails. Determine if the emails were intentional or due to compromised credentials.
- Disable the internal user’s email account to prevent further sending of threat emails, if necessary.
- If possible, notify recipients who received the threat emails, advising them not to interact with any suspicious content and providing guidance on what to do if they have already done so.
- Take the required steps in accordance with company policies.
