Reorganize, adding table

Author: Maddy-Cloudflare

src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx

@@ -2,41 +2,19 @@
 title: How Cloudflare prevents email-based phishing attacks
 pcx_content_type: overview
 sidebar:
-  order: 4
+  order: 5
 ---
 
-Email-based phishing attacks can be divided into two main categories: Those with and without a malicious URL or attachment.
+Cloudflare Email Security uses a variety of factors to determine whether a given email message attachment, URL, or specific network traffic is part of a phishing campaign.
 
-Email Security uses a variety of factors to determine whether a given email message, a web domain or URL, or specific network traffic is part of a phishing campaign (marked with a `Malicious` [disposition](/cloudflare-one/email-security/reference/dispositions-and-attributes/#dispositions)) or other common campaigns (for example, `Spam`).
+These small pattern assessments are dynamic in nature. Cloudflare's automated systems use a combination of factors to clearly distinguish between a valid phishing campaign and benign traffic.
 
-These small pattern assessments are dynamic in nature and — in many cases — no single one in and of itself will determine the final verdict. Instead, our automated systems use a combination of factors and non-factors to clearly distinguish between a valid phishing campaign and benign traffic.
+Cloudflare's vast global network detects emergent campaign infrastructure and aggregates data for Cloudflare's proprietary analytics engine SPARSE.
 
-Emails without a Malicious URL or attachment typically fall into the Business Email Compromise (BEC) category. BEC is a type of social engineering attack. In a BEC attack, the attacker falsifies an email message to trick the victim into performing some action - most often transferring money to an account or location the attacker controls.
+SPARSE uses AI and ML models to make effective detections for all types of malicious emails, including Business Email Compromise (BEC). 
 
-To detect these low volume, malicious emails that do not contain malware, malicious links or email attachments, Cloudflare uses machine learning analysis, analyzing email threads, content, sentiment and context via message lexical analysis, subject analysis, word count assessment and sender analysis. Display names are also compared with known executive names for similarity using several matching modeling including the [Levenshtein Algorithm](https://en.wikipedia.org/wiki/Levenshtein_distance), and if matched, lagged when a sender is organization from an unknown domain.
+In a BEC attack, the attacker falsifies an email message to trick the victim into performing some action - most often transferring money to an account or location the attacker controls. 
 
-## Type of malicious attacks
+To detect these low volume, malicious emails that do not contain malware, malicious links or email attachments, Cloudflare analyzes the email thread, content, sentiment and context via message lexical analysis, subject analysis and sender analysis. Display names are also compared with known executive names for similarity using several matching models. 
 
-When malicious payloads or URLs are included or attached to an email, additional steps are taken to protect your users. For example:
-
-### Malicious payload attached to the message
-
-- **Example**: Classic campaign technique which utilizes a variety of active attachment types (EXE, DOC, XLS, PPT, OLE, PDF, and more) as the malicious payload for ransomware attacks, Trojans, viruses, and malware.
-- **Detections applied**: Machine learning (ML) models on binary bitmaps of the payload as well as higher-level attributes of the payload, with specific focus on signatureless detections for maximum coverage. Additionally, for relevant active payloads, the engine invokes a real-time sandbox to assess behavior and determine maliciousness.
-
-### Encrypted malicious payload attached to the message, with password in message body as text
-
-- **Example**: Campaigns that induce the user to apply a password within the message body to the attachment.
-- **Detections applied**: Real-time lexical parsing of message body for password extraction and ML models on binary bitmaps of the payload, signatureless detections for maximum coverage.
-
-### Malicious URLs within message body
-
-- **Example**: Typical phish campaigns with a socially engineered call to action URL that will implant malware (for example, watering hole attacks, malvertising, or scripting attacks).
-- **Detections applied**: Continuous web crawling, followed by real-time link crawling for a select group of suspicious urls, followed by machine learning applied to URL patterns in combination with other pattern rules and topic-based machine learning models for exhaustive coverage of link-based attacks.
-
-### Malicious payload linked through a malicious payload linked through a URL
-
-- **Example**: Campaigns where the URL links through to a remote malicious attachment (for example, in a .doc or .pdf file).
-- **Detections applied**: Remote document and/or attachment extraction followed by ML detection tree on the payload, instant crawl of links.
-
-Additional attack types and detections can be found in the [Email Security Detection Methods](/cloudflare-one/email-security/reference/how-es-detects-phish/) documentation.
+Refer to [How we detect phish](/email-security/reference/how-we-detect-phish/#sample-attack-types-and-detections) to learn more about additional attack types and detections. 

src/content/docs/learning-paths/secure-o365-email/concepts/protect-from-phishing-attacks.mdx

@@ -2,7 +2,7 @@
 title: Protect your organization from phishing attacks
 pcx_content_type: overview
 sidebar:
-  order: 5
+  order: 6
 ---
 
 In the early 2000s, Secure Email Gateways (SEGs) were introduced to deal with a growing need around the routing and filtering of email. While SEGs were successful at their mission for many years, their fundamental design has made it impossible for them to keep pace as phishing threats rapidly grow in scope and sophistication. 

src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx

@@ -2,13 +2,9 @@
 title: What is Email Security?
 pcx_content_type: overview
 sidebar:
-  order: 3
+  order: 4
 ---
 
-Email security is the process of preventing email-based cyber attacks and unwanted communications. 
+Despite email's importance as a communication method, security and privacy were not built into the [The Simple Mail Transfer Protocol (SMTP) protocol](https://www.cloudflare.com/learning/email-security/what-is-smtp/)  As a result, email is a major attack vector. 
 
-It spans protecting inboxes from takeover, protecting domains from spoofing, stopping phishing attacks, preventing fraud, blocking malware delivery, filtering spam, and using encryption to protect the contents of emails from unauthorized persons.
-
-Security and privacy were not built into email when it was first invented, and despite email's importance as a communication method, these are still not built into email by default. As a result, email is a major attack vector for large and small organizations, and for individuals well.
-
-For more information on email security, refer to the [Learning Center](https://www.cloudflare.com/learning/email-security/what-is-email/).
+Email security is the process of preventing [email-based](https://www.cloudflare.com/learning/email-security/what-is-email/) cyber attacks and unwanted communications. It spans protecting inboxes from takeover, protecting domains from [spoofing](https://www.cloudflare.com/learning/ssl/what-is-domain-spoofing/), stopping [phishing attacks](https://www.cloudflare.com/learning/access-management/phishing-attack/), preventing fraud, blocking [malware](https://www.cloudflare.com/learning/ddos/glossary/malware/) delivery and filtering [spam](https://www.cloudflare.com/learning/email-security/how-to-stop-spam-emails/). 

src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx

@@ -2,13 +2,11 @@
 title: What is a phishing attack?
 pcx_content_type: overview
 sidebar:
-  order: 2
+  order: 3
 ---
 
-Email security is the process of preventing email-based cyber attacks and unwanted communications. 
+[Phishing](https://www.cloudflare.com/en-gb/learning/access-management/phishing-attack/) is an attempt to steal sensitive data, typically in the form of usernames, passwords, or other important account information. The phisher either uses the stolen information themselves, for instance to take over the user's accounts with their password, or sells the stolen information.
 
-It spans protecting inboxes from takeover, protecting domains from spoofing, stopping phishing attacks, preventing fraud, blocking malware delivery, filtering spam, and using encryption to protect the contents of emails from unauthorized persons.
+Phishing attackers disguise themselves as a reputable source. With an enticing or seemingly urgent request, an attacker lures the victim into providing information, just as a person uses bait while fishing.
 
-Security and privacy were not built into email when it was first invented. Despite email's importance as a communication method, security and privacy are still not built into email by default. As a result, email is a major attack vector for large and small organizations, and for individuals well.
-
-For more information on what a phishing attack is, refer to the [Learning Center](https://www.cloudflare.com/en-gb/learning/access-management/phishing-attack/).
+Phishing often takes place over email. Phishers either try to trick people into emailing information directly, or link to a webpage they control that is designed to look legitimate (for instance, a fake login page where the user enters their password).

src/content/docs/learning-paths/secure-o365-email/email-security-configuration/active-directory-sync.mdx renamed to src/content/docs/learning-paths/secure-o365-email/configure-email-security/active-directory-sync.mdx

@@ -1,5 +1,5 @@
 ---
-title: Active directory sync
+title: Manage your active directory
 pcx_content_type: how-to
 sidebar:
   order: 2
@@ -31,7 +31,7 @@ To add multiple groups to the registry at once:
 2. Select the **Action** dropdown list.
 3. Select **Add to registry**.
 
-In addition, Email Security Allows you to:
+In addition, Email Security allows you to:
 
 - [Remove groups from the registry](/cloudflare-one/email-security/directories/manage-ms-directories/manage-groups-directory/#remove-groups-from-registry)
 - [Filter the impersonation registry](/cloudflare-one/email-security/directories/manage-ms-directories/manage-groups-directory/#filter-impersonation-registry)

src/content/docs/learning-paths/secure-o365-email/configure-email-security/audit-logs.mdx

@@ -0,0 +1,21 @@
+---
+title: Enable audit logs
+pcx_content_type: how-to
+sidebar:
+  order: 4
+---
+
+With Email Security, you can enable logs to review actions performed on your account.
+
+To enable audit logs:
+
+1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/).
+2. Select **Analytics & Logs** > Logpush.
+3. Select **Audit logs**.
+4. **Under Configure logpush job**:
+  - **Job name**: Enter the job name.
+  - **If logs match**: Select Filtered logs:
+      - **Field**: Choose `ResourceType`.
+      - **Operator**: Choose `starts with`.
+      - **Value**: Enter `email_security`.
+5. Select **Submit**.

src/content/docs/learning-paths/secure-o365-email/email-security-configuration/create-allow-policies.mdx renamed to src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx

@@ -1,5 +1,5 @@
 ---
-title: Impersonation registry
+title: Add user to the impersonation registry
 pcx_content_type: how-to
 sidebar:
   order: 3

src/content/docs/learning-paths/secure-o365-email/email-security-configuration/impersonation-registry.mdx renamed to src/content/docs/learning-paths/secure-o365-email/configure-email-security/impersonation-registry.mdx

@@ -1,8 +1,8 @@
 ---
-title: Initial Email Security configuration
+title: Configure Email Security
 pcx_content_type: overview
 sidebar:
-  order: 1
+  order: 3
 ---
 
-With Email Security, there is limited manual configuration and tuning. The Active Directory sync, allow policies, and additional detections are important to consider when you set up the tool. 
+With Email Security, there is limited manual configuration and tuning. The Active Directory sync, allow policies, and additional detections are important to consider when you set up Email Security. 

src/content/docs/learning-paths/secure-o365-email/email-security-configuration/index.mdx renamed to src/content/docs/learning-paths/secure-o365-email/configure-email-security/index.mdx

@@ -1,22 +1,21 @@
 ---
-title: Submit a phish
+title: Report phish
 pcx_content_type: how-to
 sidebar:
-  order: 2
+  order: 4
 ---
 
-import { GlossaryTooltip} from "~/components"
+Before deploying Email Security to production, you will have to consider reporting any phishing attacks, evaluating which disposition to assign a specific message, and using different screen criteria to search through your inbox.
 
 PhishNet is an add-in button that helps users to submit directly to Email Security phish samples missed by Email Security detection. 
 
-PhishNet is an add-in button that helps users to submit directly to Email Security <GlossaryTooltip term="phishing">phish</GlossaryTooltip> samples missed by Email Security's detection. 
-
 To set up PhishNet O365:
 
 1. Log in to the Microsoft admin panel. Go to **Microsoft 365 admin center** > **Settings** > **Integrated Apps**.
 2. Select **Upload custom apps**.
 3. Choose **Provide link to manifest file** and paste the the following URL:
-    ```txt
-    https://phishnet-o365.area1cloudflare-webapps.workers.dev?clientId=ODcxNDA0MjMyNDM3NTA4NjQwNDk1Mzc3MDIxNzE0OTcxNTg0Njk5NDEyOTE2NDU5ODQyNjU5NzYzNjYyNDQ3NjEwMzIxODEyMDk1NQ
-    ```
+
+```txt
+https://phishnet-o365.area1cloudflare-webapps.workers.dev?clientId=ODcxNDA0MjMyNDM3NTA4NjQwNDk1Mzc3MDIxNzE0OTcxNTg0Njk5NDEyOTE2NDU5ODQyNjU5NzYzNjYyNDQ3NjEwMzIxODEyMDk1NQ
+```
 4. Verify and complete the wizard.