Skip to content

Commit a01fbba

Browse files
Maddy-CloudflareMaddy-Cloudflare
committed
[Email Security] Restructure IA to match dashboard
1 parent 82485bb commit a01fbba

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+765
-183
lines changed

‎src/content/docs/cloudflare-one/email-security/directories/index.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@
22
title: Directories
33
pcx_content_type: how-to
44
sidebar:
5-
order: 13
5+
order: 16
66
---
77

88
Directories are folders to store user data. Email Security allows you to manage directories from the Cloudflare dashboard.
99

1010
To add a directory:
1111

12-
1. Log in to [Zero Trust](https://one.dash.cloudflare.com/) > **Email Security**.
12+
1. Log in to [Cloudflare One](https://one.dash.cloudflare.com/) > **Email Security**.
1313
2. Select **Directories**.
1414
3. Select **Add a directory** > **Connect an integration**.
1515
4. Select either **Google Workspace CASB + EMAIL** or **Microsoft CASB+EMAIL**.

‎src/content/docs/cloudflare-one/email-security/directories/manage-es-directories.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ The Email Security directory contains registered users only. A registered user i
1313

1414
To modify or delete users in the Email Security directory:
1515

16-
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Email Security** > **Directories**.
16+
1. In [Cloudflare One](https://one.dash.cloudflare.com/), go to **Email Security** > **Directories**.
1717
2. Select **Email Security Directory**.
1818

1919
## Add a user

‎src/content/docs/cloudflare-one/email-security/directories/manage-integrated-directories/index.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ sidebar:
99

1010
To manage an integrated directory:
1111

12-
1. Log in to [Zero Trust](https://one.dash.cloudflare.com/).
12+
1. Log in to [Cloudflare One](https://one.dash.cloudflare.com/).
1313
2. Select **Email Security**.
1414
3. Select **Directories**.
1515
4. Under **Directory name**, select your directory.

‎src/content/docs/cloudflare-one/email-security/directories/manage-integrated-directories/manage-groups-directory.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ Email Security allows you to view and manage your groups directory and their [im
99

1010
To manage a group directory:
1111

12-
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Email Security** > **Directories**.
12+
1. In [Cloudflare One](https://one.dash.cloudflare.com/), go to **Email Security** > **Directories**.
1313
2. Locate your directory, select the three dots > **View details**.
1414
3. Select **Groups**.
1515

‎src/content/docs/cloudflare-one/email-security/directories/manage-integrated-directories/manage-users-directory.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ Email Security allows you to view and manage the [impersonation registry](/cloud
99

1010
To manage users directory:
1111

12-
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Email Security** > **Directories**.
12+
1. In [Cloudflare One](https://one.dash.cloudflare.com/), go to **Email Security** > **Directories**.
1313
2. Locate your directory, select the three dots > **View details**.
1414
3. Select **Users**.
1515

‎src/content/docs/cloudflare-one/email-security/index.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,5 +40,5 @@ The Email Security overview provides you with:
4040

4141
To access the Email Security overview:
4242

43-
1. Log in to [Zero Trust](https://one.dash.cloudflare.com/).
43+
1. Log in to [Cloudflare One](https://one.dash.cloudflare.com/).
4444
2. Go to **Email Security** > **Overview**.

‎src/content/docs/cloudflare-one/email-security/investigation/index.mdx‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
pcx_content_type: navigation
3+
title: Investigation
4+
sidebar:
5+
order: 14
6+
group:
7+
hideIndex: true
8+
---
9+
10+
import { DirectoryListing } from "~/components"
11+
12+
<DirectoryListing />

‎src/content/docs/cloudflare-one/email-security/investigation/search-email.mdx‎

Lines changed: 280 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,280 @@
1+
---
2+
title: Search email
3+
pcx_content_type: how-to
4+
sidebar:
5+
order: 1
6+
---
7+
8+
With Email Security, you can use different screen criteria to search through your email, reclassify and move a certain volume of messages, find similar emails, and export messages.
9+
10+
## Screen criteria
11+
12+
Email Security allows you to use popular, regular, and advanced screening criteria to search through your inbox. Advanced screening will give you the most in-depth investigation of your inbox.
13+
14+
To screen through your email traffic:
15+
16+
1. Log in to [Cloudflare One](https://one.dash.cloudflare.com/).
17+
2. Select **Email Security**.
18+
3. Select **Investigation**, then **Run new screen**.
19+
4. Choose between **Popular**, **Regular**, and **Advanced** screen methods. Refer to the explanation below to learn what each method does.
20+
21+
The results will be displayed on a table. The table allows you to review and take action on the messages that match your chosen screening criteria.
22+
23+
### Popular screen
24+
25+
A popular screen allows you to view messages based on common pre-defined criteria.
26+
27+
To use a popular screen criteria:
28+
29+
1. Under **Method**, select **Popular screens**.
30+
2. Select one of the following criteria:
31+
- **Moved emails**: View emails automatically or manually moved within the last seven days.
32+
- **Reclassified emails**: Emails that had their disposition reclassified within the last seven days.
33+
- **Malicious emails**: Emails assigned the malicious disposition within the last seven days.
34+
- **Spoof emails**: Emails assigned the spoof disposition within the last seven days.
35+
- **Suspicious emails**: Emails assigned the suspicious disposition within the last seven days.
36+
- **Spam emails**: Emails assigned to the spam disposition within the last seven days.
37+
3. Select **Run screen**.
38+
39+
To modify your screening criteria, under **Active screen criteria**, select **Modify**.
40+
41+
### Regular screen
42+
43+
A regular screen allows you to investigate your inbox by inserting a term to screen across all criteria.
44+
45+
To use a regular screen criteria:
46+
47+
1. Under **Method**, select **Regular screen**.
48+
2. Select a **Date range**.
49+
3. Enter a keyword.
50+
4. Select **Run screen**.
51+
52+
To include all emails as part of the search, enable **Include all mail**.
53+
54+
To modify your screening criteria, under **Active screen criteria**, select **Modify**.
55+
56+
To reset your screening criteria, select **Reset**.
57+
58+
### Advanced screen
59+
60+
The advanced screen criteria gives you the option to narrow message results based on specific criteria. The advanced screen has several options (such as keywords, subject keywords, sender domain, and more) to scan your inbox.
61+
62+
To use advanced screen criteria:
63+
64+
1. Under **Method**, select **Advanced screen**.
65+
2. (Required) Select a date range.
66+
3. (Optional) Fill in the other fields. All fields, except for Subject, must be filled with one value only.
67+
4. Select **Run screen**.
68+
69+
To include all emails as part of the search, enable **Include all mail**.
70+
71+
To modify your screening criteria, under **Active screen criteria**, select **Modify**.
72+
73+
To reset your screening criteria, select **Reset**.
74+
75+
## Reclassify messages
76+
77+
Reclassifying messages allows you to choose the disposition of your messages if the disposition is incorrect.
78+
79+
To reclassify a message:
80+
81+
1. In [Cloudflare One](https://one.dash.cloudflare.com/), go to **Email Security** and select **Investigation**.
82+
2. On the Investigation page, under **Your matching messages**, select the message you want to reclassify.
83+
3. Select the three dots, then select **Request reclassification**.
84+
4. Under **New disposition**, select among the following:
85+
- **Malicious**: Traffic invoked multiple phishing verdict triggers, met thresholds for bad behavior, and is associated with active campaigns.
86+
- **Spoof**: Traffic associated with phishing campaigns that is either non-compliant with your email authentication policies (SPF, DKIM, DMARC) or has mismatching Envelope From and Header From values.
87+
- **Spam**: Traffic associated with non-malicious, commercial campaigns.
88+
- **Bulk**: Traffic associated with [Graymail](https://en.wikipedia.org/wiki/Graymail_%28email%29), that falls in between the definitions of SPAM and SUSPICIOUS. For example, a marketing email that intentionally obscures its unsubscribe link.
89+
- **Clean**: Traffic not associated with any phishing campaigns.
90+
5. Select **Save**.
91+
92+
To reclassify messages in bulk, select **Select all messages** > **Action** > **Request reclassification**.
93+
94+
To release messages in bulk, select **Select all messages** > **Action** > **Release**.
95+
96+
### Upload EML files
97+
98+
Email Security classifies certain emails as "Clean". If you disagree with the disposition, you can upload an EML file and reclassify the email.
99+
100+
On the **Investigation** page:
101+
102+
1. Go to the email marked as Clean.
103+
2. Select the three dots > **Request reclassification**.
104+
3. Upload the EML file.
105+
4. Select a new disposition.
106+
5. Select **Save**.
107+
108+
Once you have reclassified your messages, you can access those on Reclassifications.
109+
110+
To view reclassifications:
111+
112+
1. Log in to [Cloudflare One](https://one.dash.cloudflare.com/).
113+
2. Select **Email Security** > **Reclassifications**.
114+
3. Choose **Team submissions** to view emails your security team submitted for reclassification, or **User submissions** to view emails your users submitted for reclassification.
115+
116+
## Move messages
117+
118+
Moving messages allows you to move messages to a specific folder. You can move up to 1,000 messages at a time.
119+
120+
To move messages:
121+
122+
1. In [Cloudflare One](https://one.dash.cloudflare.com/), go to **Email Security**, and select **Investigation**.
123+
2. On the Investigation page, select all the messages you want to move.
124+
3. Select the **Action** dropdown, then select **Move**.
125+
4. Select among one of the following folders:
126+
- **Inbox**: Move messages to the primary email folder.
127+
- **Junk email**: Move messages to the junk or spam folder.
128+
- **Trash**: Move messages to the trash or deleted items email folder.
129+
- **Soft delete (user recoverable)**: Move messages to the user's Deleted Items folder. This option is for Microsoft 365 only.
130+
- **Hard delete (admin recoverable)**: Delete messages from a user's inbox.
131+
5. Select **Save**.
132+
133+
To move messages in bulk, select **Select all messages** > **Action** > **Move**.
134+
135+
## Find similar emails
136+
137+
Each detection has an Email Detection Fingerprint (EDF) hash that Email Security sends to the Search API to retrieve similar detections.
138+
139+
To find similar detection results:
140+
141+
1. In [Cloudflare One](https://one.dash.cloudflare.com/), go to **Email Security**, and select **Investigation**.
142+
2. On the Investigation page, under **Your matching messages**, search for the **Similar emails** column.
143+
3. Select the number of similar emails. Selecting the number will show you a list of similar emails.
144+
145+
## Export messages
146+
147+
With Email Security, you can export messages to a CSV file.
148+
149+
To export messages:
150+
151+
1. In [Cloudflare One](https://one.dash.cloudflare.com/), go to **Email Security**, and select **Investigation**.
152+
2. On the Investigation page, under **Your matching messages**, select **Export to CSV**.
153+
3. Select **Export messages** on the pop-up message. You can export up to 500 messages from the dashboard. To export up to 1,000 matching messages, use the [API](/api/resources/email_security/subresources/investigate/methods/get/).
154+
155+
To export messages in bulk, select **Select all messages** > **Export to CSV**.
156+
157+
## Email status
158+
159+
Email Security allows you to review the status and actions of each email.
160+
161+
To view status and actions for each email:
162+
163+
1. In [Cloudflare One](https://one.dash.cloudflare.com/), go to **Email Security**, and select **Investigation**.
164+
2. On the Investigation page, select the three dots.
165+
3. Selecting the three dots will show you the following options:
166+
167+
- If the email is quarantined:
168+
- **View details**: Refer to [Email details](#email-details) to learn more.
169+
- **View similar emails**: Find similar emails based on the `value_edf_hash` (Electronic Detection Fingerprint hash).
170+
- **Release**: Email Security will no longer quarantine your chosen messages.
171+
- **Request reclassification**: Choose the dispositions of your messages if they are incorrect. Refer to [Reclassify messages](#reclassify-messages) to learn more.
172+
173+
- If the email is not quarantined:
174+
- **View details**.
175+
- **View similar emails**.
176+
- **View submission detail**.
177+
- **[Move](/cloudflare-one/email-security/auto-moves/)** (only available if you authorized moves).
178+
- **[Request reclassification](#reclassify-messages)**.
179+
180+
## Email details
181+
182+
Email Security shows you the following email detail information:
183+
184+
- Details
185+
- Action log
186+
- Raw message
187+
- Mail trace
188+
189+
### Details
190+
191+
Email Security displays the following details:
192+
193+
1. **Threat type**: Threat type of the email, for example, [credential harvester](/cloudflare-one/email-security/reference/how-es-detects-phish/), and [IP-based spam](/cloudflare-one/email-security/reference/how-es-detects-phish/).
194+
2. **Validation**: Email validation methods [SPF](https://www.cloudflare.com/learning/dns/dns-records/dns-spf-record/), [DKIM](https://www.cloudflare.com/learning/dns/dns-records/dns-dkim-record/), [DMARC](https://www.cloudflare.com/learning/dns/dns-records/dns-dmarc-record/). The dashboard will display Pass if SPF, DKIM and DMARC checks have passed.
195+
3. **Sender details**: Information include:
196+
- IP address
197+
- Registered domain
198+
- Autonomous sys number: This number identifies your [autonomous system (AS)](https://www.cloudflare.com/en-gb/learning/network-layer/what-is-an-autonomous-system/).
199+
- Autonomous sys name: This name identifies your autonomous system (AS).
200+
- Country
201+
4. **Links identified**: A list of malicious links identified by Email Security. Refer to [Open links](#open-links) to open links in Security Center, Browser Isolation or an external tool of your choice.
202+
5. **Attachments**: If an email has an attachment, the Cloudflare dashboard will display the filename, and the disposition assigned. You can open attachments in [Browser Isolation](/cloudflare-one/remote-browser-isolation/). Only PDF files are currently supported.
203+
6. **Reasons for disposition**: Description of why the email was deemed as malicious, suspicious, or spam.
204+
205+
#### Open links
206+
207+
You can open links in Security Center or [Browser Isolation](/cloudflare-one/remote-browser-isolation/), or copy and paste the link so you can investigate content in external tools.
208+
209+
To open links in Security Center:
210+
211+
1. In [Cloudflare One](https://one.dash.cloudflare.com), go to **Email Security** > **Investigation**.
212+
2. Locate the message you want to open links for, select the three dots, then select **View details**.
213+
3. Under **Details**, go to **Links identified**.
214+
4. Locate the link you want to open, and select **Open in Security Center**.
215+
5. You will be redirected to Investigate in the Cloudflare dashboard.
216+
6. Select **Scan now**.
217+
7. The dashboard will generate a report for your link.
218+
219+
To open links in Browser Isolation:
220+
221+
1. In [Cloudflare One](https://one.dash.cloudflare.com), go to **Email Security** > **Investigation**.
222+
2. Locate the message you want to open links for, select the three dots, then select **View details**.
223+
3. Under **Details**, go to **Links identified**.
224+
4. Locate the link you want to open, and select **Open in Browser Isolation**.
225+
5. The link will open in a separate window where you will be able to browse the content securely.
226+
227+
Alternatively, you can directly [open links in Browser Isolation](/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/).
228+
229+
:::note
230+
If you purchased Gateway and [Browser Isolation](/cloudflare-one/remote-browser-isolation/), you can perform more actions when opening links.
231+
:::
232+
233+
When opening links, Email Security will not allow you to:
234+
235+
- [Copy (from remote to client)](/cloudflare-one/remote-browser-isolation/isolation-policies/)
236+
- [Paste (from client to remote)](/cloudflare-one/remote-browser-isolation/isolation-policies/)
237+
- Use [keyboard](/cloudflare-one/remote-browser-isolation/isolation-policies/)
238+
- [Print](/cloudflare-one/remote-browser-isolation/isolation-policies/)
239+
- [Download files](/cloudflare-one/remote-browser-isolation/isolation-policies/)
240+
- [Uploads files](/cloudflare-one/remote-browser-isolation/isolation-policies/)
241+
242+
To open and investigate a link in an external tool:
243+
244+
1. In [Cloudflare One](https://one.dash.cloudflare.com), go to **Email Security** > **Investigation**.
245+
2. Locate the message you want to open links for, select the three dots, then select **View details**.
246+
3. Under **Details**, go to **Links identified**.
247+
4. Locate the link you want to open, and select **Copy URL**.
248+
5. Paste the link in your external tool.
249+
250+
:::caution[Warning]
251+
You may encounter a `400 Bad Request` error after turning Clientless Web Isolation on.
252+
:::
253+
254+
If you encounter this error:
255+
256+
1. In [Cloudflare One](https://one.dash.cloudflare.com), go to **Settings** > **Resources**.
257+
2. Select **Generate certificate**.
258+
3. Choose the **Expiration** (5 years is recommended), then select **Generate certificate**. Your certificate is now generated, and the dashboard will display its Deployment Status as INACTIVE.
259+
4. Select the three dots, and then select **Activate** to activate your certificate.
260+
5. Select the three dots, and then select **Mark as in-use**.
261+
6. Your certificate deployment status should display AVAILABLE IN-USE.
262+
263+
### Action log
264+
265+
Action log allows you to review post-delivery actions performed on your selected message. The action log displays:
266+
267+
- **Date**: Date when the post-delivery action was performed.
268+
- **Activity**: The activity taken on an email. For example, moving the email to the trash folder, releasing a quarantined email, and more.
269+
270+
### Raw message
271+
272+
Raw message allows you to view the raw details of the message. You can also choose to download the email message. To download the message, select **Download .EML**.
273+
274+
### Mail trace
275+
276+
Mail trace allows you to track the path your selected message took from the sender to the recipient. Mail trace displays:
277+
278+
- **Date**: The date and time when the mail was tracked.
279+
- **Type**: An email can be inbound (email sent to you from another email), or outbound (emails sent from your email address).
280+
- **Activity**: The activity taken on an email. For example, moving the email to the trash folder, releasing a quarantined email, and more.

‎src/content/docs/cloudflare-one/email-security/email-monitoring/download-report.mdx‎ renamed to ‎src/content/docs/cloudflare-one/email-security/monitoring/download-report.mdx‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ Email Security allows you to download three types of reports:
1515

1616
A disposition report shows you all the email messages based on the type of disposition you selected.
1717

18-
1. In [Zero Trust](https://one.dash.cloudflare.com/), select **Email Security**.
18+
1. In [Cloudflare One](https://one.dash.cloudflare.com/), select **Email Security**.
1919
2. Select **Monitoring** > **Download report**.
2020
3. In **Report type**, select **Email disposition report**.
2121
4. Under **Email disposition report**, select the **Date Range** (required), and the **Disposition**.
@@ -27,7 +27,7 @@ Refer to [Dispositions and attributes](/cloudflare-one/email-security/reference/
2727

2828
Retro scan scans the last 14 days of your emails, and gives you a report on bulk, spam, spoof, suspicious and malicious emails.
2929

30-
1. In [Zero Trust](https://one.dash.cloudflare.com/), select **Email Security**.
30+
1. In [Cloudflare One](https://one.dash.cloudflare.com/), select **Email Security**.
3131
2. Select **Monitoring** > **Download report**.
3232
4. In **Report type**, select **Retro Scan report**.
3333
5. Select **View report** to view a report of your last 14 days of emails.
@@ -46,7 +46,7 @@ The reports contains:
4646

4747
To download a security report:
4848

49-
1. In [Zero Trust](https://one.dash.cloudflare.com/), select **Email Security**.
49+
1. In [Cloudflare One](https://one.dash.cloudflare.com/), select **Email Security**.
5050
2. Select **Monitoring** > **Download report**.
5151
4. In **Report type**, select **Security report** and the **Date range**.
5252
5. Select **Generate report**.

‎src/content/docs/cloudflare-one/email-security/email-monitoring/index.mdx‎ renamed to ‎src/content/docs/cloudflare-one/email-security/monitoring/index.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
title: Email monitoring
2+
title: Monitoring
33
pcx_content_type: how-to
44
sidebar:
55
order: 12
@@ -15,7 +15,7 @@ With Email Security, you can enable logs to send detection data to an endpoint o
1515

1616
To monitor your inbox:
1717

18-
1. Log in to [Zero Trust](https://one.dash.cloudflare.com/).
18+
1. Log in to [Cloudflare One](https://one.dash.cloudflare.com/).
1919
2. Select **Email Security**.
2020
3. Under **Email Security**, select **Monitoring**.
2121

0 commit comments

Comments
 (0)