Ticket types for Email Security¶

Coro raises tickets for emails when it identifies the following security incidents:

• Blocklisted sender
• Brand Impersonation
• Crowd Blocked Sender
• Domain Impersonation
• Email Phishing
• Forbidden Attachment Type
• Malware in email attachments
• Missing Required Authentication
• Reported by User
• Suspicious Content
• User impersonation

Blocklisted sender¶

Coro identifies that the sender's email address or domain is currently in the Suspicious Content Blocklist. The email is deleted for all recipients and the ticket is automatically closed by Coro.

Brand impersonation¶

Coro identified the email as potentially containing spoofing or impersonation of a brand, due to a detected homograph attack on a domain recognised as a popular brand. The email is moved to your selected quarantine folder and the ticket is automatically closed by Coro.

Crowd Blocked Sender¶

Coro identifies that the sender's email address or domain is in the global blocklist. The email is deleted for all recipients and the ticket is automatically closed by Coro.

Domain Impersonation¶

Coro identified the email as potentially containing spoofing or impersonation of a domain, due to a detected homograph attack on a domain recognized as frequently used in your workspace. The email is moved to your selected quarantine folder and the ticket is automatically closed by Coro.

Email Phishing¶

Coro determines that an email contains a phishing attempt such as domain impersonation or any intention to mislead the recipient into revealing identifying information about themself. Phishing emails, including those emails marked as safe through the Coro add-in, are automatically closed by Coro.

Forbidden Attachment Type¶

The email contains an attachment of a type included in the file types quarantine list. For more details, see Email security settings. The email is moved to your selected quarantine folder and the ticket is automatically closed by Coro.

Malware in email attachments¶

Coro scans an email's attachments and identifies potential malware. If malware is detected, the email is deleted for all recipients and the ticket is automatically closed by Coro.

Missing Required Authentication¶

The email failed to meet the enforced authentication requirements. That is, the following conditions were true:

• The email sender's domain is in the workspace's authentication blocklist.
• The sender failed Coro's authentication tests.

The email is deleted for all recipients and the ticket is automatically closed by Coro.

Reported by User¶

The email was reported by the end user as Phishing through the M365 or Gmail Coro add-in, even though Coro did not detect any malicious content. Tickets remain in an open state for operator review and close automatically after a period of two weeks.

Suspicious Content¶

One or more of the following detectors were triggered, leading Coro to identify the email as containing potentially suspicious content:

1. Malicious link: The email contains a known or suspected phishing/malicious URL link.
2. Suspicious QR Code: The email contains a QR code encoded with a known or suspected phishing/malicious URL.
3. Suspicious email content: The email message body contains content that Coro identifies as suspicious. That is, the email failed a statistics-based detector test involving customer and phishing data.
4. Suspicious attachment content: The email includes an attachment that Coro identifies as suspicious or including a potential phishing attempt.

The email is moved to your selected quarantine folder and the ticket is automatically closed by Coro.

User impersonation¶

Coro detected an Envelope honeypot: User impersonation event, whereby the email potentially contains spoofing or impersonation of a user. While the displayed sender name is associated with a known employee, the sender email address is unfamiliar in this workspace. The email is moved to your selected quarantine folder and the ticket is automatically closed by Coro.