Ticket types for Email Security

Coro raises tickets for emails when it identifies the following security incidents:

• Blocklisted Sender
• Brand Impersonation
• Crowd Blocked Sender
• Domain Impersonation
• Email Phishing
• Forbidden Attachment Type
• Malware in Email Attachments
• Missing Required Authentication
• Reported by User
• Spam
• Suspicious Content
• Suspicious Metadata
• User Impersonation

Blocklisted Sender

Coro identifies that the sender's email address, domain, or IP address is currently in the Suspicious Content Blocklist. The email is deleted for all recipients and the ticket is automatically closed by Coro.

Brand Impersonation

Coro identified the email as potentially containing spoofing or impersonation of a brand, due to a detected homograph attack on a domain recognised as a popular brand. The email is handled according to the Phishing security mode in your email security settings and the ticket is automatically closed by Coro.

Crowd Blocked Sender

Coro identifies that the sender's email address, domain, or IP address is in the global blocklist. The email is deleted for all recipients and the ticket is automatically closed by Coro.

Domain Impersonation

Coro identified the email as potentially containing spoofing or impersonation of a domain, due to a detected homograph attack on a domain recognized as frequently used in your workspace. The email is handled according to the Phishing security mode in your email security settings and the ticket is automatically closed by Coro.

Email Phishing

Coro determines that an email contains a phishing attempt such as domain impersonation or any intention to mislead the recipient into revealing identifying information about themself. The email is moved to your selected quarantine folder, and tickets for phishing emails, including those emails marked as safe through the Coro add-in, are automatically closed by Coro.

Forbidden Attachment Type

The email contains an attachment of a type included in the file types quarantine list. For more details, see Email security settings. The email is moved to your selected quarantine folder and the ticket is automatically closed by Coro.

Malware in Email Attachments

Coro scans an email's attachments and identifies potential malware. If malware is detected, the email is handled according to the Malware in Email Attachments security mode in your email security settings and the ticket is automatically closed by Coro.

Missing Required Authentication

The email failed to meet the enforced authentication requirements. That is, the following conditions were true:

• The email sender's domain is in the workspace's authentication blocklist .
• The sender failed Coro's authentication tests.

The email is deleted for all recipients and the ticket is automatically closed by Coro.

Reported by User

The email was reported by the end user as Phishing through the M365 or Gmail Coro add-in, even though Coro did not detect any malicious content. Tickets remain in an open state for operator review and close automatically after a period of two weeks.

Spam

Coro determines that an email contains suspected spam in the message body, headers, or attachments. Spam is an email that has passed Coro's malware and phishing detection and is considered not malicious but contains indicators for unsolicited or unwanted content.

The email is handled according to the Spam security mode in your email security settings and the ticket is automatically closed by Coro.

Suspicious Metadata

The email contains metadata identified as potentially malicious. For example, the sender domain is flagged as malicious by one or more phishing evaluations.

The email is handled according to the Phishing security mode in your email security settings and the ticket is automatically closed by Coro.

Suspicious Content

One or more of the following detectors were triggered, leading Coro to identify the email as containing potentially suspicious content:

1. Malicious link : The email contains a known or suspected phishing/malicious URL link.
2. Suspicious QR Code : The email contains a QR code encoded with a known or suspected phishing/malicious URL.
3. Suspicious email content : The email message body contains content that Coro identifies as suspicious. That is, the email failed a statistics-based detector test involving customer and phishing data.
4. Suspicious attachment content : The email includes an attachment that Coro identifies as suspicious or including a potential phishing attempt.

The email is handled according to the Phishing security mode in your email security settings and the ticket is automatically closed by Coro.

User Impersonation

Coro detected an Envelope honeypot: User impersonation event, whereby the email potentially contains spoofing or impersonation of a user. While the displayed sender name is associated with a known employee, the sender email address is unfamiliar in this workspace. The email is handled according to the Phishing security mode in your email security settings and the ticket is automatically closed by Coro.