From 5c73618e443c056925ca90497dda7268fde04eb3 Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Thu, 14 Nov 2024 14:45:19 +0000 Subject: [PATCH 01/21] [Email Security] Learning path --- .../api-and-journaling-deployment.png | Bin 0 -> 35677 bytes .../api-setup/ms365-api-deployment.png | Bin 0 -> 26884 bytes .../secure-o365-email/concepts/index.mdx | 16 ++++++++ .../concepts/prevent-phishing-attack.mdx | 36 ++++++++++++++++++ .../protect-from-phishing-attacks.mdx | 10 +++++ .../concepts/what-is-cloudflare.mdx | 10 +++++ .../concepts/what-is-email-security.mdx | 9 +++++ .../concepts/what-is-phishing-attack.mdx | 10 +++++ .../create-email-security-account.mdx | 17 +++++++++ .../get-started/deployment-models.mdx | 11 ++++++ .../secure-o365-email/get-started/index.mdx | 12 ++++++ .../get-started/initial-login.mdx | 8 ++++ .../get-started/prerequisites.mdx | 8 ++++ .../recommended-deployment-model.mdx | 16 ++++++++ .../learning-paths/secure-o365-email.json | 8 ++++ 15 files changed, 171 insertions(+) create mode 100644 src/assets/images/email-security/deployment/api-setup/api-and-journaling-deployment.png create mode 100644 src/assets/images/email-security/deployment/api-setup/ms365-api-deployment.png create mode 100644 src/content/docs/learning-paths/secure-o365-email/concepts/index.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/concepts/protect-from-phishing-attacks.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/concepts/what-is-cloudflare.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/get-started/deployment-models.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/get-started/initial-login.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/get-started/prerequisites.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx create mode 100644 src/content/learning-paths/secure-o365-email.json diff --git a/src/assets/images/email-security/deployment/api-setup/api-and-journaling-deployment.png b/src/assets/images/email-security/deployment/api-setup/api-and-journaling-deployment.png new file mode 100644 index 0000000000000000000000000000000000000000..dc84e52c4c410749f732efd93bd9829f463ff17c GIT binary patch literal 35677 zcmeFYc{H2v_cj`>st%@VYo?_wRr5S+tD=LUYOa|grRI4GEj0$!YAH3hC@NL+5TWLI z76fU<7$SlQBFTx*=lebHyUx4LKj)wG&(B)cy*!cq-1mO=eeG*s`?=$v>gzC_=ROYr z0GJ*Cb08p87;n@BR0Fbcr=)pbXAi7QRh2}5*;gUzxOM*Avy*R_#a4xPhZ$i8_ zE`TTHZs!)2?u`!Joon7^b&+|sJloHj&a_#VEBv)>FqWv9e-qhMFh#Fc%zZ|!%Q{tL z+C%K>4p&(j|}AH&zcds=#-KL#75A2O9^<3E*AsTW(Xbvcm(J!7GZnsAX03TVZg^ zO*-1#0Fbc(`jc^l;kwX2_@)I~1p}u|xu`oj1)zJqB&iWG5Zvs7*_3FNUR78ytcWuAy{%whf zSf1S&KkTPe;8x2dR25*pHZAJcqt)W^GN`H41`%cCBSUhKT z+wTykNZIn_Xv5i`18_Ekkc7i95F!WmHC87K);QOqbUdP{Kn{l``5avLeAVDSFFXtj z8bJ-`HfhaN1P@Z6YYDa9e$J?!DylU_b)RhHLNPpL_lm2RQOg`o`Mmd|!0zF^lq&f{mQW;h z>inhp(^4ay>D2IU&K-#qO2~9p=y<1^3I!nO>Wj}Q%I4~eNK-ar7xsp z{lyU`_bf)vT}RPe$?NFogjSO69bA-|WZ3e%d#WSh<-Lr4(IAjcl;ndvnK=e8#RP_} zN5x-^7#@ubD4NX~w*Ys}MQ&aG>!5CT@s8)wBkm`o(*8#lxsp1X`Z0604Ne634UqG) zo+cJiYXP^{I#t9k#PvFvRsD$SMHu_l4MXZA06i&LU}7B!4Bk$acN%uD`72<{Q1JT7 z`0pghnaJ9_qd1vsmxuH%N(?pj>uHqUF z*o5+ib?tf?jc;W8_05DMf$ia9#qQnMZeN>h{ma9)$4!%&p?H$#)rcx3RETO4!nn-; z61wKSj(i8>sJX95g@7$!$IZ6{$yt%QW!r3umbdgU3$y>8($}+C^ARrf_Bay?=b$Xg zCT$>WFFZ+*G@B$1L&?Vnj;Y5%HZdXDQ_yr<$w~#cGPp$*;wd@cxw_6_(7U=alyjLQ zJs`VSrBAZMTN5a`qHtIDGk>DgcDpuD(a~qFI?bu;=%+-1Tx_twqICDFO_>7FL(BB^ z^l?MbLB6M}%K0i2p8W#BKLhUX4j^D;{@HXQa!4%Il*Ey{>RpNosD_qe^Gvh52@1N^ z>V@K?<>GK1ZvlLmDY6V_6$YBADA`&C%?5bG>aorIA(WP#TCD}8@>-{sl)noRFs8K5 zz>m7Is=9plft;uD`8?xVrA)osPjR?{{7W$Spy;`-vtb??OY-M7rqY?lek7&yj-|ox zoNB?~z`?7q^@2N;7F5d;7TpdDu^m++!S$8OP}t@0WbAXjiarUSLsX~6Yx{XT?Y;GPDYEh z{Q=fE7t@+-S;K;Pj(g8qa0h`^t))&pzs3SUQ^`D!cog0=j7sSEQhve3k=K6gOM=ZL zf3gop5UQF?R=sQ7KM3fQ)GZ5$&BBT&Tg=i@+%3?m+VnnyIo+o2iRC89A4lOgDITM* zRn3ty{75^Zz?p#3?4C)uwMkik=E!_BWTfce8uTn=bUJP{da_^e#Q{PPa2)IQsR(b( z!g-ec`s1<~P}%op0#JMAr#QFZZXd(cRA-ALM)$a47Oi5cuerM`F5qaj@G4UujoUk< zOHowp+eK$H;=^D?fyOqVsh)&)T8X17Veo2S}Y@Z#ohG;j5 zFmefh28w>brq|>&GkTW_Oyk?Q1X`2UTasdQqOYO3WV&L(@&`Pd?M(}{)Gx-m`Gi{(&{)mR9bM_%|QOxmA%+}dlXzO1YK zkMEx`l+KN1-TYK z)a!Awc^2Jk57Uh7hL7*V`xo|_;Mup@n;U#dWL_b__*PPcPR~bqH`OHtUrHE%=}`bI z{4yd1dAw}xLU`)C@vPXdMzs{ZjqyKa?u%U|!-_R? z>7YPk0n6&L#ij@Tw|Z>9_=eb$ZfNdXnnsjBt<9J&Yx%#syXh7_I23{uzu(@*aNfAM zP|;0C@%Lh?i2=@7qb!5b=w-(%ghBe$LnoO@t?CrxH_%d7M;VP{$ILdnwnwT3_oU{| z4_4ax4^Fjy7v+(Q(zX4O(#ONX<}uX?o-FQvQK|1V8Ebi*UCPwa`%EBdyJCSY#D7$& zx&B#i<)mAwv{U$>hpix1(_(q1$&6u)I$q%LPgCq1oRw+#_>3q8OeT^M4od9&INk7L#QogpJOEKFt4&$)B6)F*e#9%teYc0wEHP`;TSrpZ<>_rZ`+{>hkw zhmcOjS4EQJEp`sZn*9r=cLdFHW#(N&+^q*@K>?bR!-v0WbPnhw~#mr=@P*2im=$k!tsn*<^tyn@+!I($bMyQb1s*(;|Hny-?kOTA45 zZcmk7N4G~hg>n417^DAdSzl!^6GBXuB&W8RtB_-ea zOOUM5&%7=m!~8`i+;RNAgMZYIc8*0~MPP=1f|`5Nf(GPe?__F@$>hEvtWdRo{6ki- z9(Lz%b;Cv>WkIRu;RxgOj#$yrS_k9I4yfIAdE2!zcck>Ra+YG?tEh&v0v^_r4W+ZS z=U6m%%<=UM8i5HTbWvA-Z4*xT%|9R-`{?7Bs56iZ0_SUEnNKLJt`UKDSw%NHKDw=1F zSP(WEJ?<9+P?L)RlU#z67MDgnGS?hD2^K*1nOgcHf$Kum`6}YRDj*a8x-X?x^pB;_ z$lcGxlnm-mxK7MGkT1fh&l=Jfeaw)N{W2OPDWF~0=phKtFfL9ofm@mIv_y#~Xt4Qw z8~9rS)jHFseRz10E0LihN;) z{WBK1*uoY`0->jDie=2STyp+Haj2Qrsv^G}e#2=B+1#G3uNje3%OvGG?6DlU@+jPoL)eVADGq2%M(CEtc5OOu#KhF%?M{>&P|;LtHNWU_O6(DuG{J>a zB%R_^lx5d-+)z}rP9Eql#uN-#!1D2!x6n-z@o$ZxKFYPSWuR}i`ZLCTBC5}sDa&+Y zO1B!*(&^|q#S_{;e5=muv8-oEI~^HZVai&b8Mms;{de+>2-_<&TOGnEBZ~J0`5WU} z%z5ChNSkvhw0}C~ubk5E?-h&iBQsMJ&KdeK&=e@DAo|pk>~M9s_kqDj=1D0zv*TB{ zG@Qbw%xCD+*i{HvcB5>{mWu) zVO&q{l&IE}PT%s|_NqIH2-~VIn`Q|?&WP@FE=6RN*FYZAZ-boB-bhq8ft19}yRw&k zMCtUkh*(%`k!W#nduPe=tjauH8XmD2AW;zwCur{oKdyN7IUBwiaWQCXk?`wlo#P^r zBSM61EBxhSR~Ccj-PJP5*qz!1<|@--;-u(}It)FQURtkyp*9{ME^4DgDw>sm5Uy|V zy`2o`s&jQmi_MOXR>Y6D#frb28Rf{VNm)EBvsvA~UaDj^iB#Y)QHj=4YdM&MCb$mx z<0YXwsmmErYM83JXi%2V9DLyc+p z=b)=wFkG}yzs*W<2$g~liStr{>RnDc!fc3w5v~)c0tqY)56=bkVDmzd&OZ$!8lq%ob=YpKESqBZ=7kQM%WiBi_BOvu zS*@8`(Xrx>T8;(z&+b{nUu{NBG>^d znWCq;UbfF8&@#wvIGO>v8ukFaA|y<;w@q;g^NJ{YG;AdoCt-1fr(=3wf85^bj?nr( zC(=td@~BuB+{5`A1lb%QO_d9)6j7|KHpp0dwjrzFnFj4^$8U?&i=9pvgCez~{F|4% zjLSx&@Z8^VZiiNiGqo49hd}dj$?JoadVA07j(k`V0=*MU&Ljk;U#Ebw4dg<*t(++t8~%Lch9_7m#I+l1cR{2hBAD+f%g;^{GRr z+3iJZl62E!G6ULw0ddP~I=k{$PaE(-=ew0heH<~u+8Km>EtD~Xwm;#vboRs_uEf<4 zHL7zVZ2m~_F#8}ga}yC#2SWhtl)6fzLYg&%bebZPL@3%aPV66_b~vwb`PWOg~>(bhVwyti(PSDB1MLh4D4=X^T?2}2ZTZA$vU0JhpK?P z!f`_wXZNhNpJ10*G1zG-w##6;qPH2BE@_*UUI<=Y7n_Wfe$#Ef*T{26H6W4m(Q}Uc zt)MH0bO25RR5PWEE?v8o^Q}Ihh@B=bzZ4R^2An=1XL&rj3ehlwT+NiyirLv^GBA zMYZ@U@#=%>92qITb2R%mxr?OTokR_+*V7WFe>^DR6b3~8jccv=pw+~9<%$fQlr{HB zy9o5*9os)+;{S~QpZw5YPTyLuOp}nl=^)%KDWP>aN$WI)OWiK(MDp58vJBwz3Vy|d z_@01FK$fenB)N@ApM`RH9nK)ISzF*&`tW{WqrfU(sKKl!!X>swz|*2$B71*7c6K(! zByj)h6Vol_ax$Z^mCs#E5?h5bIoTf9z21qH5cPm(lk1m4LyJrT3A)qZW^gXkI$CEQ zH3gmvK+WyF-5~PsgN5#AP@y@w- zgp^m3zq(7kA1+Jf@6QVFN?zJ^xq)SmNcnNBUYofU!Qx&r3g+6q5MoYePk&{`lU=tQX#D~Ays!lb0e$9 z;8^`u3S7sf_r&0q)W7Xq|LnS`mBl zRI6!Q{Qqr~N^be-fb-k;C*6wtlL7F152q~TET798SGMs#d!4rAMlz*g9mSvZ0r2L; zwCVh$Q4T;Q8*LKEDs$?@syo~NWBmLPz^Rycwc^RiWB>r8kMG#*cu$_`rMoL9cPKM} z3(@(V?k?N1Ym_^&@P9Tf-DFNlIjNH(o^GVCG{ag}oc4ZR&f!{pz$wxi=^?c!#8w`QdZc}N(z*Smg=B^Aar2Q|? z-HihhykRn0TR$Q734m@`Wul=?|eXck45lFg-^P@Z&$} z@%xpWCO%L1h{zM3Kj^m}`;z|Zu@3(MC^I=HCMJ{;1710 z_3d_H2aH(!6Ic-FmRZip<1fTF!lu4yiodC0oCf3X8XV0rkE``;WI$z42z$`rL##^im4-&sMdU*~c1yU1NNnG*GUqdR^eyCw;GBgJ{rwxebXk zsC*+e-11YeaqE-%xF$KIcxTm-1uVk1k6E|gV*oV1K5>5Ig8}C_JLw_M`tUj$iV?*S zpf93l>>U(z%T+&LXzlG<3P92WS3Y|`09ry||MCk!f{W~`J#mn@% z{T4ZA4*q=b9eb~cLQOs?eegP+k<(EnD2LyJtPNP>zYpx1><vfQws*+xvSM8^pwN~%&OFaCpxx~X z=?im4D=hbPa<5Dck?zE zsnOBXY(Dqzu$5qBFXV1|R2^DzgkNxKrs`G6y)Zy;GO|&2<(!>#n7;_9V4 zGE4?-zJDWizFD_Ln*@CVm~X|Gs?w@p*5LU(&g}HinKMbJt!rFyEitvqQ3 zWl1>>g%cjAtPc`}0eQQfjLjJs)l29}%J+cH0M~!N?RrT@CSOo3@pdbl6tI2gc!TFc z8a%AqW!&!yonr%dj6I3)Az5jAR60xJ3;+TbX&HM|;HX&SXlp|soNdYqe9ZyKXuJ%z z|E-MX6X3EWVqh6qX%?7ruj=qyb#95m!)~IEb+3S zvpmT>P=%v5QDL~!^XYXzDL2FqgMQC?X+H4Y*=~8z1fI_C0u4%OfjBl1)z$p;&~N*x z=SM8BR8I98c=9q`q;&d)-%F>Yq)mbak(Lcc^5>DAC7qnGl0n((GwQozeamKPRDN6@ z8=x!UUFxHcG#j_jevI6>kXIhIt(-|%PW$apXqX@!0Fo}k_(6vS7`oB8fEh>M4lM2Z zB{jN2dNI0UcrWCD`Iv=tftzkk^gi&GwVXn z=66K6TSi5!cUDOKD7`b4)4?{0B^oAQzHeB2%H6y;-6#FJ_tS;nVfauI;Yu{uM&J0P zf&qQj{4a__c@$@{{`k18WccBG-|@5hn#C8nh5R7fY(S4E+-8Afs*2~3v>5eicJ(Vufr7phCX^HWyJDYT>Ykeal>dg5QwDNmH+kt%oIP2QFAvl=o zqe8&Ji(m+s%Rvn^Oz9_ZXk89kFCuU>IeoR;T!nfx)go7SGG(!MRnF z<-`6JzIO`|+XiFxAKdhLlFjDt^(ZlE_Z*aUuM~}P55JS<9ksMqe$#a}_luGKGS>$G ze!Snj0Z~_x;#Tys+ z%>~r`fY&b_bgu6+^Is2ImhbQ1Elg4J(>>MYHH$Pk%+aq6Cg8rt|C(3u9bdSxkkN%q zG+6kQ!T%4mdULCILH%DAGYe>&F>!ahi4H%gcb!}ahaJL+mIi4;@@F7`yTx$|2wEZ% zMYJckN&|(G{X%>%2gOH9&%T;hb3_*w=VYju=ze5oiv}OQ-@OFs5_hxFMPnn+Aip+9 zem49Xp)K4VqdIoLlk4yFdX!B@Un>??q+0ajL80RP&N6UwAmU8Y=-uJT%UX&*bm##W z{q_}E9;T$&r=}@h$xf-<_Y;l_=qn3AzLSuA^V^(*WR^0dSIiqQ{BzbyTI&|@9?-Cf zvw>5H)4wG72O}r6IiMjjwHCJCgw||45RQ;ign6f1Bt_ysDSq<~+#Y5>$(Kcioon!t zH=ITxf*^=|l*4&{;l%a(lacti(*jqd^c_!tB8Z=9XBwW4+k16Nr8PkHYjU-dFaF%|doah~ zmj?Hc-hu2(tqcKd|yEu&$y2d?&!s3v-qxkf9=)`;vM4J>1_Lj zn!0bvR}yngnuBx4$0FudCnmlts2>iW%TRH+3iLO2D2E-C-YR54|HA0L7ug;wAN=Sk zG_1Z%MiJKujipz!n$hlW%aeuDt`49wtemPz(=F?*|PUcn97V2=^@oV zvwu4|D!Jl&WgML`{IUtu+DE$XC)ndE{4zRDnfKMrI$wtl^wYOQ2YU3z{&TY-mH44Q zjIxEk<|B*%BU{CA(i^%0!!N~)5404f=o0+7yDjDIAm2w%b@kQ-%pdJxc|3HpokuAf zV+C)gR_VEU*)w#dchRLLp~N!~oy+bejDXnjn0WV?^PE*yKP68MtkF~U6j?-c6vu+W z8&1PTr-`-TTmR(-ey}xZmeHW3m&&4sb8n6Du;8KfK&ujs z$=rIy0IVK$c;N`if!y?P=&M;D2S~}Ea(=!P)E|^6&rKA2(`BW$a=by5M7qPNneyiV87k2b-P_WQQXy-*etDn{ z;0UMsTA@j{&1HH>HVsH}7mjOWK+W4v%+fdHz=w;z<1a$|+|mA3$WuZJfbQt;7<_RZ z-?~ZP?S5Yy8Sr>aA^Fl|VPTZq7A=_xJcbkddN+FFQa`N1c9TzNuI>rxSPst7U;^ke z(bU~9jF*MXA*C_F4;wF9>{s`On_JkD%xtQfn_tO9b;&{( zpla}=J=IH*j=v}NIwR&hJMN*g5(0YPdp{3Y-ai{MW){&LsI0DH7PFOh%D?-v`>zbA zOK0{RxC1Y5$%b9A?>~4v$(Asa9~k$kz_^1_UOXStG8nq816Yd0 zf7K=$U>GBN{cvQKy5spq|BZgOsKJiqjpxS_bHr95@d%FbYy@+_{Js6}M@{;S+;kbU z0o>Y=iZKM^kt_JC(d}q8HfGOk7fH37s{gbbHmxN)tc%%LoIKlXdT(V)#IG1 zWm}lr!{IN_{-?CozqbnOzg#ZH{c}{7p9#VG@k+ZL)AZcP;QpQ8o!>7@#faDB3cXX^ z*4#w-kjyuJemt{FIvaAjq6x7j9)TDiKWg+29==vbO1QUwJM7P%?--0IDJg)M$yJi4 zYc;--U1*DCS}(w|PZl~RVe}P?*Lu`xtT~+&){brZh^@}h2=B8eX3*lm`eBdK8Em=X zl3ktc5vjr5B%S2aTR~@yT;R9vTQk(E<8n%LX^)LGO?Wx`i0HgTnh_R_+hb*_x9rrg+p!nd z&mJk=k}@r5mrIyiu6?4LlKc`me^tsk_;Z$dnKbYPxDpiDxkeKWLpghU(%6%>`aS0A zJoO4(p+0PILOdWji;7_{r7WivWM8S$-`QK|oC%t1WBGjIzPmj= zX_thUgct{|M~^ z`?tMsd@SXPKv9PD_&B6awVEd;(>k36*h_5=TX(Y`7htcXh&yL@{E}xY1s4Cz^WL-$ zZ>*Vnz4hncV!JO+dsqlCKzoBl{IrUm*=qldRw4 z7R(lYPc8o3Jk^z-@EdTqF8(uj@a+sx(*qq>dQT&9y8*!$kk2Qz5$NCTaJ$0r}}w@=}XUZYa37XeUJH@@sS|G}LbdyZiiJCB+aDIbam@sriuN z^H~1F9iRmGh`sm*Aj7p(R=yycy-I?%D~vhZp_=NLp_cXW(O#b6&Zq7Q06QN>uJsVZ zpEse!8Bwi&_c7ffk&Hr)d|iKglIB56K+h1}zlSvSA?vr+lR!-cVfP@9ti7Xf;~sim zcFu;}W2C-Qs1Q&R7`nWqwe|T|A%|sr@?VgP_H>Y=C&^8;{N6c$Q4%fLUm1_7cwQ6O z2m^s)MirW4d8ABlGq!tW`_8v4H^@JrNn))JweuTUpVXy2fek#Q$u)I)sz?joV$nSJ`hH)Fm6Ho&OC0pl<_lO9|Ylh4bw{3HYd@)ryi$U@0Q_{cw zB%<8PKU^L!$(^s)vo+)bM2^O-x2aktI6XvKax{tCKA$lkpGyz;uWDy~v*==YVO^<% zoM?*jLH^!J{iavc%>06x+Yy$R(Z|A^F$ z3?m7wvT2Aio~9KcQjOeeSN~H*b%I*Wu(LBlw@-w!@R~q!r`K2kN!6L$`8VV+d00W5 z(RY)F|1nMRn}Jj?G`{^u&eYdplL`1GvhAbA*7MdpP7nY+Yviw0|WietdAz-N%LDq7Y}>P6^SwW(%}0h z?H(YY+3ES;|H>@Jfmhlb=phYn_A1Y6$}L|g><}5uV93#V3B1R7kESTH53af9St|Xb z_kOsQkQauhNr6|sI!-u1wpBML-NyVz>K2xglL)tjK-Kyu$BjmQ&}c~l%~A6|LO)TH zTg7RfVgrvqvIssZQ5~lh!))bUe%>dx0V7GyH#6=U{#m9Ga;#+pt>*Z^0&{s>0avo> zZvLD9>y*Fl=j4}YHn}d}_d3dB^BUj@^2@EwbTk?(&Zho<&K+t7o8$(&Bf3n-a82xaFU^O;6`)8@DCQ z1M0tSkkTw0PAitK?eo-aS(xT&?A$#OlO1u@?TO4(u5)?lf8}qq#QEkW0*B-Cy--wG zgvw9G2~H7?=!Ry-7Xo5$W@ximeUh+x5di2KD&?qjOwbX3BPR-x-G-=p8S5f~^Qk_R4$mZey}M zb&sffo~i^r*<#Z1+EC7pKlRhwkOe?D?bKJ1#C0L|#dyIRq{Tqu6RG*Imrjn~0k2Q7 z{=0DJTQu8%NCjH1t5P-^U8337o zrX+eIO}ENbgZ?)Dw|JwesCL{cSS-uUNRN}GL~9rRV@vSltD22f!sNAz9QyxEnsy^j z9oy#(F2R(mZgGI#e|CQVLm&XKc9*z7^=drSsr$4#zf$l7`Y2X_+*VDiVCVt5EcgHU z4>Rkgf{U2NX5<&*;gkMIIeoth$?|E{?C|-P|8z2Fy%RvBbdAs9746n~6&Sjw{ZjVE zK56yVt>HSFm_}Z--4dme*A2dm`DKx|B9yFWkfUCEY_UbBsqK``;rD@a%1U|ZQqxZ_Pu@OrUgggDFrrw;Vv@t$9%67`lr>t>rZIx6c2oqC=^V1Z#2 zmg?gYYYdE5@!!Li-uvD)YMDSh>czEWc|ZaTJ}+H76be_t1GGa_5p zOg?ZBup zZ;+ZLt)_??12}Sx8&5y$oM|(>$&i_Im!v6hdU0oaIdPb8?_l5z=|Ka3V^`&E zU=$+#OWeEt#xexF-P>FkcFz}IZCh=<{Y2TynG+r6y3 z7U$zDzaea)5sJRLd3?lu{bTVz!Qo1^ z#t5I|SCtV@^v%CW9FNH_qp!-yn1t6dvS-0sBBo#TzD@zJb;$e_c&VCaw1fuorj%me z@)j{)l>s+_LOZmxLZsO;#$0Vu`jP$Y+%vuQY6y z(R#;WJq47A(^xJ}F51SFAYRtisz!1r;BQh}B&@=+d#g6yB>k^N+lh%u{)Qb0^4Z3C z+Dsn&;>C3bNp^?IEkN0pIzzo@a&t{=uG+Su>pA%@;}^+y$57lD`~W;%~Dx znKR%$y+h8%e}{{uz$g0`HFhw z=2SLL24Kc)v@%@xjy4Ff>mo&5I%n_2$+HOULBS0z+hbiEYeDc;#}~({E#|~MxvA>D zLfA0nU`ihazg^qg`5a@fqp{yX*1n#35Kf;#=*J++NN6L2P1Ra4asKv792x5LkZaN0 z-xD{naeUDC^UrG?21wtFSI1NRIeNY>o{x1af&@BAbw|oPJ0!V4kr(iT)h6y-s^v4= zNHeT1glN~CB6&PE*%?Y~_L1{aev)55G}uYHLwlt@bY+;wYaS%LykV*;ScY68C+WvC zuI*^(90YHM4zD$32WfUINXrT)bI|;CVBL%ok}9|1r?%k4Jwe(K?k2`G{HKzn#Fgu=mb@l9r{(qCXUxUsa4S<7q-T^TjX6sdE z8>U5xJg~>b0{0-=23G2FaV)V1Qf`y%956@krd-OwZKsE9q<8SA-Tn>&J5H0~2b&y= zr-QXnC6T)cEXV`a1Y~@8pV3(~1=FUpb$ACMBcF%2WB6VIq-0JVD6&1 zsmZ)f*Hm!#{D+J%oGN9_Z-Jb?&%?xvYXfO@kfeauP|c+Tf@71bi-VQ0#&Ds#*Gewg ziA%;AzmP&Y0I?mcO3BzNN?NlL$uU|B<4_@)S;N0mS#VQ+mc@W%<#k9)q{IT%CA?G` zqXfLwy~7Y3@PPhP1Je%eps9i6%z9uS7VM8?3h%DMEaP#1dr+MPXgQQ;3yg;GU)5}X z+S#bo2Z>GA+N)Ir@g7cpPO%QY;a`T$u=-bG`r5Dl9Dm(dLVqFDE`_D}K&pS-A7gZ| zBe;lvoxwu!o}a$uAsoS(R%i6e%vwh}B0ibrYglOIyt}p(mr!15x(U(#kSU3OpYaNM zU&wsmLXH{YMgl2uW2q}RJk#M=BjnFw^Xz}!-1;Ym+k`X36^@IR99M4{ksa)C)41Qj z$c3&_Vo+Hcg5AU^H+n{D-wDpsvXYFT#tn7W&-=rKAXT80rPSYqjg?4=+IVDqtsdlA zg+vsqd(=%BvLo>4=88#Kzk;rnB>$7ReXZ!vmCg69Jj+#Y?gmyi4}TY9pM0nKtib&$ zN#KcprxV+aF0d&wg>7e{nfPPvk;Y}oDn+wXaLnZv zdE)U;weYV8BaKkvAAv=+mX7XN-91RB0zRJ=If2-X?=NtX*ph7Ni9L94L&K{yZrx)I zoDoGZmw0e^Jt1TiUh>sbzG=;$>FgQr~2ZfLbFl*&3@u%S-G zQwFuF;!|g7?IS!n8q`!47oUILk&wn8$96eLkWe3Uj&}i=xBNx z!PO|%wpu?vuMtvGnWXPu--`HYLzPXGJcAF?@H(1#2}cOb;LOdjgcPhpM3%cwMDjV^ zXbfmmjKYT_&uR2#U$`TB=1XaI5lQ#=*d=JFyJLq#xw3_N@`E5cBkRk07x4T^#KoNj z{Z5QXhiQSM%tZQ~c-&1k1&NX*75*Xr-De_)Fiuob-~OY~tptS*2~tZ93h>T$kKc2D zri@zYh@0yQvfD(|qy!jHJg(TgR%`jV_->WQ?LUhyy%171L)G)Nl!W5=1fwAqJoqrC zT0SYc>q2}&8UUZW90DJoJ@Xu%pDhm2d9jjuPcMX!anusrFR>h7nI1|;lRu+e zXfDmK#t>3~&iwZ>mTjmYt8P*l&3E++CNQQsS7=07+prLnr1FemoiL2xaU0zb;1hKV z)e))15Nxf&X5#mcQ|ta#sn zt}*RTB^7*tPWo@4A_~M=H^y~TZ_nN)?F}s|)z^*tCJ=D^)oDN4*8mA8NQ zOgqaIGjvId2EOWei0L}=R&oB!U$85)wEQ%NWHW$GRr@3O!1Bf{U**tWyVJLxTL%W? zhAVIR+ce%(F+@+ZRjK%_IviJQKE%5BPv{7)B9*sm+9l5`PE&GB{9>9h1f5TA#%9YF zf(?TK&u}~9-qcBebX~Ad94GNgotbT&bfCxu9(&s9m4{{}XOn;YZu={tqLKO>yV2;+ zb7>^U8Aj0&@SgrzVJT6N14M10HXDD0kR7Q7M;n7Mx3k(>3PtJ$FQ5@ULKRwDgcM19 zr9tJV#fPEf4fr@~Y~>YPzw7HJrJ@InW}cQyqln4mlnV*0e^L^MA~AcbMoIbJl3F@|RG3poM_Zba^P_^KWz%4tlwr9RtSGR41=kU&Pb)9Bf zMi?7p*~zT5>Sl~D%tyU@5ys2MFuHz-UHIwQi`QXM`B@M$>oA~T*r_sQjD^zgof z^%b{ift{781ZG6jQE6LufVV({-c`Ob?^p4EB%yCn)l$}a6bYhj0vTi~BH1CbxyBlA z!4drFp$+DGMJ}!wk7G|vUMuTgz43dL6oP;;H=M4K203|G=H6kLPwxHq<)N=`ODy#m zxn__b5N9Qk`HrW;%%q5O<&Df?lxKknf}_v258W=SG4OhSoq!6V{#YZ#Zly)FsR;?y zIbjM*d|98eT;djLN|7-5F?%;Si$*%5i;zo0Us7#8MGTQ9UI}cZ2q%kA$~*4jWdtmZ zgZM&EgkS@|n4qN9n@0NF_paB}+eoN7sI(x zPK&D|6`xUA((TvHJ|-jM-5s;6YC=RtmD!LVuRA2-9(#u(2v_$YWU&i-gbI6Wc<$P( z_yBvq^Ex72by=#4rQM?<2kANyEVX?9&=-tDD)DA;?r^5uddgL^K%K1^bcbn* zxgW_?D`^3lPByCI;xu7<*!8jm8`*Y_Yn>b4#@Tsk@kuB%2fF=+M#s+4{RWpiK;Ag|B)( zqk($@Lqyygp7WUqihh3`+HZ~{;67`@FWxwdOs4R%+j+4uJSaAR*bHdzF&|^e{k1u% z5UJ|6Q+1W~TjuVv8GjkVgc@@HE);pO&B_+8X-~gzoZzyZr?pQ0zygJf(*LjazB{O? z@7p&ZDi+X43rJC-0#ZVdCRI_uLJ=uaLx~Cq0qN2aQ4s=&(pyjjRGRc&1WA+*QCcVh zQbX?~l(&Q5d*7XVXMQtp=FOWo?_K^do=I|Y&faUUz1C-aKI@FEin|#j^k%i)%tw!H zbK)q?&fk8<+9}4>edE&7ej?w)^F!KFl8`e%R{psg@h6{oL-un|t+%TR=_Zv)j_@j$ z`%VfOLMJzFNp-@=kyVu$hi-QO60ge%}<2<9(vpuGw#J#O~(FtR8;q;lRP|x zIm!X@^RsY`07GGk3?aYYtA$ka-B-Gl46g%_y6X~w(0{-+MwT<5rFnh-SdJUpki9am z;oG~}=^^-Qte%hb-IV(I#;V;Pwe-ubw8z9W@;f6xR$Z{qy43^Pf3Qf@GrT(Ft9KRc zwT0LA5NeMAdSm*>8W!)ly}LMl$?4si-@H1YkGqB2)TJmLp9@4FG^IFTHYS!bvIgXU z0;LU9u)9aochHU_V~HJpzSd`{d>nuT7G5+iVjXKSU^$3p3J{_u;_A7tS_B2sh%z}K ziI$@TUu(9IP=j|PvOe$n;i}yiWYBQ!Uk*|aPDA3n03a6~DpsBG04?P;PVkmA&xk@1>}W z4F-o%!}0Fgj?d(|Iwsk|0IP=qBG7esa9Umwr)7b0mj4vnIz)EpC|A|Q+Th;|)4 zs7kshBH9+=yWlVC?++4oQ3Tc1i8pp|;|e?*`xsgJ(%En;+}WM*Yr4e0{1P36_!hwI ztaRwCwdW3~VmVq>)_E@V;L2pWaBazZZl@<*-t4h(9`xKhpT17j2;XddJ+_`OQZR~Q ziiJYo0t0lVtkiG=^RKno9f*n5 zR|S!Pt`lz>w@Irc9VFw#S-5VS?}lP-Z#AggIF9Qf3sVbmqkCzXHL6=df`YluPYvOqqyGFrb^L4li^o71wZAZ)TAk z1hqXA?ugCPL&OKiOLR5z!%GaZ2RFM_51$8SeCZ7stEU!&Z#G2cOU1^{MyF8YS1iVvm>ICa*$-z~FhM#r-(M>h zd+1WcBH_3Clcft-o}ri!OC}y8CYGr~G-DpHzD7TF=r8}{UPz!A+Duc9YlLR&-aRJU zhL^jRh7R)zWeL^W?5u69i?nNdQ?DJV15CJO84et2*`u6^tx(CT!lhV~?UItQS&Y1E zS`Mr7ut8AB#^BzKCF=8WX((y}^B!I5m3&h907N(THPmZoQ9bO_^?YV@uBko#fNakA6X| z@Oo(gNrBS=*wbYL?b7uEkiPRuyE!{X{#ilGU|M0$iH0WxwcynvDvg4IEc&O$qI&qf zMqc4IFf3_2hpC_eSw$nj^i5LCeJMOgQs4dsn15dHEwc!|_*2}pa@}6zKN6F zZIuG+2>caY{fEch=xPfPUfZdn2EJRiYV=c2_9p~zyv3PB`~A)S&d^s^+W@E4o?%kq zK2Zta#sH+PlQnj`r@haVhCnp*Y49lkqDBAXD>(080%LL;fE+%GF^Pxo(>=-yWzN$m z;{S&JPV#tY(|`YqIsY3@46t3=3Hz;R#O{9$2meKU4f8$Zs1?5dR^*U)1E}JIGzJh@ z;^21lk8slA`_h2ehNb}M&#^{VfIafW=8lYC#cc{+wDNeFLP;3;rz06~lw~YP=%KO; zJT8j~bg_isPnCR$#D#*$d4eZl= z@g%vZkgs*%;RAkCRV-;TnTP6iVvligJ0Z7hnSsx?m`7iYXY=j`Q=YW5% zarF}F$>`+Ut({U)Pll_7k>U`@YR?gjz?{q!cfQsvpkN7EAA`6S{G$kfa{{}_I7|LU z|4*%lcKE5vef36nE6+5gt+kuN^Fyu-Zj|SF&Wc^Y5Ysva!cuz|4neuyliYo)Xdh zgpvGDmiaG~1~kL?S4xEc4ew)n`vDV#<;q`W0{qm-=!m+%_*}t)2{F1S`vzp+%q@DI z>z+`RhmCf(pPs;p+Ax3+0~qU~-T^$|!!|XKnszWU(grr*to{M~c>+RfL3Z@Z@-jKM z;tUPtX9yE-1!f7}zxwL{9%1f`8eUizqQ`@s|D|XIP~kHMGHe%0N|3#wZ!9$ z6WX>5(~m$>S-uJ40rph(pe|1T89wpeU_!w30|R=9ToZ7$aV4yi&AZ##44^9c{!25B zIGWedY{74{J>6=4y1S(AC#b`KYZd<(8T5i)EiPsM${|-w{!hO?1SLjLtyqqz?G;k2 za3C!Y6RMmv6DkKY{Az1=YRacesFUlJ_Vcrv)1|0&d#@d((-bjkDPiIR-{7ye?&Q9> zT_QQWn+|Gr77micf%_^V}b0J6k(BJNqw2jbA~ovnq+(AUTk`7dQm zK+Lbc?*m=KNb`v#4)GUxtY=3KQU?ZINsN5M8!_t5{scGvJKG?>yeZ!@6g9NruaFRs zkJh9)x>P%#4bZY>(o=G@c88i&G_r+Ba5zm&h1+0tv3fo|r+cDe_clRM3M)!0XF)oo z40b+4Pl_3r)gjYH$LXiYrHTUbkYnI5hE_m-+)U*j@w zsT&%K?w;Zgz&3U2=eMTqRk>Ys!&)fp%$^8oHRO0 z@@~mXir)0UBKPIoGXh#12PiIbz163 z9P00yVds~v+QBVo4A+d{mnY8)h&YrF0w48dzK*GJ=j6v9D*U zd+pp2r!F~EHPgMkjAp=IIki7W4SGym3)Oog%LUXB7dkjC%YZ;$pa(;Gpcm(rK~f_Fnd#l^Ndia!(h1)fg81W zBLYZq)4gxoZqO2^YYx<>#CD<5N>I-Q8+?FP8n7pgH|Gg_$qpztyUQv_AHZTvbl{*H zi|!Fal$a+CIsE~R9RE4lDc`Npm8KPgt7s{U?d9{6zz+pzox9HvaMR!f*Cjfz<~l@y z-FDC=91OcRgs=ejRq+hidB<6P8&l`{(Hb0}s{@V`P4y*rgCR_DWir!^oN`JWSgzSM zunc)70Fe#QLLh_RXff7*j*b4~@zGlF_7wrIWf|Lv89o6#K1Ols79_IH-l226?~B1eAv&uRRz+YVq+$c8K6?UYWzLl7c<`Xs2+`yTX~n?!lup}+8Ax(j@~~S_ZUe{*?7uXPj8c6D@us)1ZS}9+%C6Ey}T<+!FXrJ@GV_bOOcFTv3<*&asyFWJ~ zkQv*8i!IsfE|9RPnq#GO^U;l=wVA3E)LiG6e-$>l!HA@A z?Fb&fhx8Xx{$9ufX+C$KTezAG?wm3bTjp`YOeB4|ddQXePm^6yU*0il@)`9!G1Z5P zsC5`0!Y(KkI?-QvPSbNiDmt4vGF&Iph2{n-&a}L3m&Bn4G`rcUdz(bnFBR!~~zA* z58$gUJQGs9dnyM}76tnoLuw+%oB_jUoX|D;mbmUQ5anLG_>C?)6X*F3=}T!8JHoX> z2|X>nUaLU=6HL6!8tcvT)F96ae91>+fiZX#~Us9pPkYU zk7lit?n&|X2t7DB?fl49BXS6J&~}RT?^iAkl@y<8ndeA;J&{vUGMopuF)e)O(qoHN zkvdv+#bbZ<*Xi9AVk{)CH7BqKy>jEi`N+9N3EpMNlskw@1*$9%*jRk#1h<=+;;8iK z@q5*$v2naSX)rSDlc)1%X`UkBlMU>kp`1@un*kL^a!W{9`kRetvh%Uker&FvtP>Ufd6QI7rersQti?%)Sc?%lT z<<_UfmHvLk>`$Qhu@jE~eJ!5juGf9;Zd)uVbd68Oo_n*B_SI4j@@0q3!A9HGo41K? z)sy49-qzkEneN60s=);Q4x^TpZv#w7_QusXZbk`` zKD{*7CWPA!1C-avXXG(TA)Xy*P6$4 z-BTi-7DpvWxAPiC%4KL0KH}rE?xkbI6iSm+n6My{0*gY!8mZ|S49I!_@?4qR zMe)PI@(ZuK)=A7&uNc{TviW2c<>;Gv@@mhtnpM9C`Y{{ZG)Sw>K(SmpZaAt-+06V< z7}5)Qw5o`!S~jz{-8xaP$ZtOSaC8JBBbXo;R;aZ1qi8&unkjl%^j6{tFBf_>wf%t1 zo{bD=r?U`a)IGrkzhYWwX>m0!j*Ewk=q@(|%SSD{CBplnP4KBi zaybu<@M#qK?-Uj_%&^(6&*%#^e(H(gF*iOJBOm(?ZM@i3v{h)z`aV4XgR;zhQ1|ouGa5+=ujmo-xq`VIzs|g` zYraE9D3L1hR%g5QeVhn`MEtOsX^J}I=C-iEM@OJoUkhj0W272#orL4JN!oeywI>=& z8h(5yDf}XzW6%dDuOD!a=&RG&0(>_M{i+M{my+g)6VHOMuYt+Ml~_G$4L$b4;bXzC zl8B+cxEUH7to%%iIZmHFDBg(SDN@z*{FG&A|Yx?!qTkeyx#LEuP0fq z1ruRmUv_w8qT7cjF0X{BeZzy_Jy1G05LaW$@IvRzgLTC$V#0*Ia_kJ{wM zE<8GEV-ih=&aQ@$2vKA*LVH?Q{e+>plgPL4jb@XXMU#Oe2eCWrr8lmlq)U+nPA}(9 zbzGp`=3NnXUQ45(hxzzB+R*pNJD|f>g-i3aR(_dRb;UV|xT@-z&0%egY5$yFE*L&) zQjl@wUAk@eN?2R}WvF1rPvs|AdW2KRTqvel2kYeBtfe_!l6Y6%iq(oC6#2+0k4Lv3 zXz#2`FRQzdFn7JCnZrn=a#>sHW zm)`6qE1#RelNV|v6^f@eW7?U3O8?vHM4rsiFOoToWN3KMr@r1d zWl!U;bu}29glgf!7ZD*PSnEU)`W8Xvx57H=RGYDks1%sCP7nd2?;UL7$Pj2j?3lL+`O{?|Cpjk(4Z|iz( z)lZQ0kJf|v-7VJ#+HOwoQbeZqFmOD3K5bu))nh&CdNqQ=k++=jScc=z=;|PMp3IwB zGgsj61UW@0>Ic0^Bt}8?*~XB+)RAgWV?V~hh^bZ~M3+5fIygkb6PdhKC?H9Xhkb$( z(@YLxjTnMJ=!2ASl4bj_vW^Tvs^H_4c7B^3iQ@uW-|J#Sv|wn!Qly)ZB5|CJ5$u*e z*KUzhcs46de?ORDUMUglW`<~Bpqq`9Q1H*{l%YB@L+Ql5pcnAIn$lMN5DS;*#rc*O z0eW&p-?7~{$Q~F&^%)HYS36?{*TFM^U9jr1ckEFH$Eu>z*bgPn14HD2E{e*h>nO@~ z>t^TG%A(%4Mw3n>edW6Cd>&q-uK?&RWM(-*MYWgxprw12UtfTx)n_LW`XNoLugi=u z^08RL&&4=iMGrT}weNBGa~2E%pK`L-eQv>jHPB*r4uR2pa>k~=TCewL7e0XJ zR77YaJju9o7OP-J#G@?PgFI)-f9f=?!Fz-k=^?BsLR<&U<+75}b#iODaeFL^ie7@G zc1@P)=X|^R{jQT9&Hj$m@N`>zV64F3b8t5RnlUj_KK+b_`T1E6ig|9`F^I-B9Vxlb z>cj4D*J8a@%QmeR^H^X@%VHVY>lMkc1AKYL`?!gOopt#&{KVjGx6RriShuEwpsrH_(>(a%vaIQ?Dk z!~+qUh0I7zE_@)EQZ@cSd>l$ovfG3$=vC*l)3{r63DvJl6gKqII&M3mavL@eTMJm&gU!X_LkX@2cF-`%v2t{|;7kje zud2wr14fJnT>CZ`-2}y}xDu$CvS^oo*45J8f#e6n8YcuMpjD*Tg(*Nm2geR$_m%PMkI{YQky<*e%B_4qEct za4)!Vt?Wo1gAoeqZr6gzozhUQsmTXH8Maf1QsYt~U@^;Md)aOd-cZw&LCO&4{}63W?FW8>P7gfz&r5=fZ!%2? za#7?V1BPtv-3zVTl;QJ`)N9wrr}BI*q+ed)YBYPF+=U6bBH3M?YsbE-YE$O4W#mi5 z9WLA&@}Idk^`QGHA!8(jdGIqP#Xcz2#C_m0ok_eH6J(C-Zx@Q%ooco z$hCQSHtTR0$a4$C(ygU4bY9&7?MYgDJi#_qiE_GCu6Dni52N>5OjW;W&&eTSXU{Z6 zdV7AZDWpHhl*~|9FYBGR_7~{2v-Dhl^O73zaA4DFr4@bO zic^xE&Z;nV>AAl`-om7FrDbkIoRnRm>i04bQwpRi1LnC!w(5aeo7r{>^}&OV%|vwj z&Gy>m)Eaa3J7pP+M>$$XIpz_sb-km<(aIG()f z3`JfXEfo0Bsx8wUW6vi35Zq~`U6YkKRHCiI$2Ot-(E~sdK()m5?$omoX8~#zUPsV! zXt@}7F-17A(ZBuWRqam0jaqs%oIO`DJWwXgrV39vv!srohXyf1K>l;D#&~+kL zbZ^j6@0)mz;`X2A(5pcyg$6#Nt=pYV!0Ajp8%lx%tT$G)%cE+ukB@XG6-g?()V;I4 z7($TRuoiA=`}rih56r2ozdM;co|@0yS(b}bl~W6f3{mMa1w>+~y zSRgF8-eH&<-+Mn9?;K_Iw)h3VsXe=R_)QQdu%q)g_sT`mmF4BqL4<~IkU=Q=%~~Jg zVas1(&dKyt|GwElh>a~>vg((nxr+=V+}?esU5{}=b%@2E<(B7+u(T;-5q$|zo>*MH zsvbSL;^&H~ZALe(x*(YS1|@71w&ZQ`xnPFTLE&l8xk8Gs>S-~x*ACJl(1iUpYXXv* zpeKd*Oi?eMMffgu`JF`>oy=h5@))S;yk?$DDy#9lCijoS)qGzz$X~~;7xZdBy-+=~ zmB|0wM`7338a>#ELOMH{E!_C_^?IGGM`ez(jPMl}X;yRQQAv-rHQS-jc3mYP>txOB zQ*Gbl^^VRg`kfxO0%J;*gF}jnbfID|0JebZ`PJ#GtCJ$Z1D7E`pR{rvncaG3?yr`A zl~YVjby_F80Vb_5Y=hHZ%dUE_Fl-fbND|0T0$$w}W-OejzTMo(s1G7c;)L4y29Ct+ zU$Ue02%O?O^SC(Gx~+i)F)hSwjX35>gU&TSqxj44bh8l6hxd$`k9nzIDmlt^4Lnz5 z(x1BL>(ZY)wS)6*pOGy5@evPl!AGoN;JHx!yWxq=L{}(W)$;_|=?i94oy6Jx|s`MDHn_IINb{8QXN7=!0R zy6bOGN}FGj2*lg`A-FDZ92T-*p)US32_bC7j8S>pvjuo>7IrI{ily?7*a9^22&DJX zZOmLPrc1H_-D%*t`LrPH4io1!*CvO(Hxtnr1eL;KSZTPGX;i=jElBC)Kj*V^_QAX8 zxLww#CLrF^ucb$v?Y7{)dT^S9V|IvfQ%z6}0dkgSqF+$+=ACuJE?3ix*DcbxviScD zlo6`%H`)#`W5B7d_*X7OODAvVOPaNs78i(I;3$;+Ow2$V#S?H2Ed?;U&OVboD>I(P zkEuLG8H*r{`C!PmblY0$;^kONG}!RP?j`HL2y@#xTD85q1aiaNTB~i9a&9rT$Fh2L zhQ+BHa`N^)WlWF&cYBoUlX5?o>{dfW(nia%hJ^v{+_1z1j)Bnk@?Q(Y#AQKFqY-6z zdZ`u{*M*Uh%Fy(uB&dzVGzw(SEtCn(`Hj5V;pza{VYb?i4^%0|)99A}lZRl(ettMw z^?p}@ZivJ7OQK=$9q|m+1v%yPYIl2v7imY1qV>jZd)%^U`?@i7W>|>QEtuy82sFj7_YI= zPohw9X%lm~{)h5v4;J`MMXsq?+)3Dih^JV2tqvpXk|tIUy#N8uiU~@DKpKiYm%N*7 ziTN>W?y9|p8-|?&UJub+(O>EDQ`?$_rP_!T9|QUq7r@e8I;9(rUbVtn`K*j~Kec4H zlf=7D^&Il*e?snvm2&>bESx(pt?E|1^oTflBDqPT~Pv4r!5QjYaHM_4v zuwUX-{vmW>0P=cgbs4VJQAU&N#ci zyM`@}>MUPZG$^R&UN zEQ){oNMMAIvF_!D1~|>nu!RM5%3;O%0mujwMh1#^t78KYd6_WXRDoOBYjK(PC*98A zjBp^yQD3+L)QCAE3@!tFOk9#cP=6Ket2gF?$XNYeF+u#C7PyvsFNxnGNSYQxi(F5i zR8W-55Ia#!Qw-CPA($ek<>a{_Y~uX3gV%fryz7|Eo<2PUW|w#Z6e4_AlO)M~#kL#A zv^8Aj%RWuJd+MQ6xIo8!SNIo&^lS@Ji=a+W=DAY&zJS)rXSx$AhW|PKgLUL#_O$GP z8xNslKM#wMxhU>nv|#~Gd;&aDs!>@io&s#Ki}HlksgJANlga#Qmug%iBz0&xg4gcnji|{>UZ@n*GRPAk z0ZxTuw~3(wIQ>K6puB+!SF@M)tr-86XCC7oN>-?p#>j1%FJrMoF9e5HB2?+1Dtfc0Sja^kaJZ zS@nTf>H9s-c-MYjieV8{}Ond7imh0av_x(YHL%>EW|XK zTpL!eSC5^#&-%Yn!?djfHiDU_-dIbtaM$dwtS*OIrSz(*;~b&GjhFX}zv5AGyuQAU zjrE4!0BCSPdOIW(uSZ%sqS!HBR6HCGBXt6xs&{$N~$}v7)Uq<%{%$ zM%#(c(YDQWwQ$oQC)$!X0J(QiC{zMpH1&~p5Cif~e_Rd7J8}YR1c&Y(deH!j+^kpb zK3aX;g$J*hNZI2i#?;4Lb~y#9iwpU(^l<}pAp*ExYJ40!5BPGzY9dFb>j3BAWyOl# zNh56~(?gz#){cXFnu&)UDyG{O*4Z3ywku0begDSczg#-qXtGqo`xeh4JmV3m!|yG*$41y2uC% z>`AAw<-&xa`&bkf8gce$b&J;+m3X7-&gmazn$W-)_hDgBKN-9UypXXQ5dDh0Da#;sLuZgC_yDrGS;xpctNxNw!D!OqEe5#V=TB3pXb0-zjT zePy=4_2&9&QG;c3$$C#1AOQ{!K&_NjdT(MRN=#8Ez0x3aa$QkSapP-xSZ8Q^#(YW7 zRokmhC3A3(j7*}AFNb=^#z3fQUC)Q}C$FNjn_+OyQUxz{&WjEn1LNaSQ_BTIDhN_F zby@Q6X>;x;eI*eC`UWvW`xR(c8UcbhV))ke|7Rg|)Y`SUTV*UwKiIhc>N{Vmmy9Z0Lb6%O} zt+f?pHrK4e@CA=n-B+4BL(4mEXE(^AOAmD2s4gpKl(vI&PHrzGHm`^t1|AWTnh2iP zS69RepK>ps$#!Nn1CzR4=F$}^KOdR#o>tqO+44irHB5&3TR+o`Z{yb(nE$f?a$X

k~J6jmgKN~71oDPCEy;V*2km4qe3;*X-cJ-T9WmGA}G!C4zK?J+|nc(w`aPp zXC4QZr7mTTc-GOgA+@I()cHlUJ#%qRP-7?|TSDnK5y`cR>JEwsd-CH(h7e3%euI{Le({py%aj(;vx(%^5n z?%a_G2F`;|aqSzOWseC5PZXZ?W-LMrl-|PxVc3%rDnDRso1MB^f{4mxJK?4?3$?5x zXoj%lb86zeJN~>0;Y!P2YMRBWR%e!xNv_*gXW>{V%{mQ&!V2xktXgj4HuziLVJSWt z$Om2%vN=DwN348z2(U(3TIL4DnxJg^PeHx~R~TG1Pl@4vhhngzHB}iO2TB+l&t%38 zhrQTJikU&Qf2{*(i&fDhrm^rb2!p(c6pPUDZGe(gWjS&yX98=e#?JMf(@Za`GOMaL zeckv*cm2yAxy=ZzSNH8Q6-R6>^<>^R_iSCpqs2-@aj~ZzMDqBQ33EH|%c^0?@f$MA z`0++}lRaPEr7AHI9H~q}Ip#BE2SOv0#Ton)HgB#a+jcjN+oD8muqPi67OD=FUgP43 zP?TCMPzZ5a8BrGiWYy--J4;pV=Eg6~e+7uBjWtHioJjI>A1-k+a%)(LCHLNZJCJI6COVnp zcIqFDuVq<242sV8H8nWF_moz=)et6n{xnrskI(W?V$ZHpQ1tE4+39}hGqV+ix?6N~ z!XXy_v)}r#*4wr;7|j=aXwA5F;EIsiPtmD((n0~{dpS&}bhcgDAiOHn_6Iar)rJFp z6kX|Klr2*>yIt56AW~n>_`OEQo@H{9?dg!J>dE+0&QIKRjTi!Ggz5ws)sBJkspmA0gpMVEAKK10=7Z8jEe?h374|nH7GvUi}QZA%1kNMG5 zqtkQMx;1dq0f7j-h)PRuETfdm_p&OFpHn~sE<*PV#7A|K1=D59w`j#<+sQm!BESub zh8L{*S4&8&naD>x-&m(%XN^h$XF_^?{G+l4(zV3i0`3RA|taAxPFe=9ZhCN>km4w0-V0+#Q&P^|8;ce zcDT8zQf|R1H^;K_ZTT<)`&FU8sS+HS;I#6-fw-P!z#J!C?Roo_oiyv&-`nq>c1%#P zIvN*LnkxLjeNDW_fPq$`-+I6`;K&^?l7ycVhS&0w zQ=LFbhu7ch_c(}Uh1OU%j1DDtTQLOq0ngEaJW*hEae2S%=bY8WMWuy4_#m~eVcd1P z)0kv(?t;T5Eofb|eulEE%4OdQsN7KhhGA3j@d&=n^4fOP4xgR&OIE#Co$vGaguOCv zzKlq5wxWL_t>t!(E+AaWnz}mr!y1J3n&UsmVMd0ac`C&?q#=J~D~i{s2gYW^wz1Te zhcgLBVTDMLy3JxcyQQ_ms3WW!DW$gWOIU9nR-P z2Yo)9H}*sy^u&b?!r=TaPh%9`uhbmooiA;DA`ALTjC*Rt@47GOO_$b;r!pLG1uB@h z@Q^Q#E2GL9g*Ce#wy}9B(Y(~(4|a|MYzAgI(kB0*Xs4v1@`vCujX1~%gSTMstTevW z0%;Q@A(&raZMw5uw#la2Do?SiwQ*~CkD9Suf@T=6KxQEQ~B1*g`o;*s+{7lDos~%xy zmQt^-5y&^lz`9F&o_1doOdI81rk6jt#SmC7t5JR;Gv&@9>{(v( z*-4t`1d=i94Gc@{B>7$`pi^w+H%<{c!G`FNvSod{c~VhLWXKoj$!nW+GaBA(7>*u% zVTV7az3p>*=B~AmTkY~T?eUJFJySgBobA+KMyRK|ie@KYk~Ya)D(3*fW#Ok^YXMFx zR~@x9awkoEw~&R@Zpieu zUz?+L*Nak12b3HT9CtnKLL;C4+Oc;t*>ZP28#80mP^J6}m(^oJ@~-^V`F=}jtmN|s z2ZenPRLii)?u-9&+0TTT9qb09>Z6YmGnZ? zVixEoAU2|hvuQmwE-y=D*!ge0>AY9|VkGWwBl-Zf;>pXTOe5hMgK#Ap!DakAz9KV4 z+qMD!^tsvRiQQRB(OAfXaV~74)~=xuFtJo(W5pYtF!^scI^y0i9S0!=L=Xc|oc@A^ zUE6N`*bkt1aFzzn7R_S>P7LI#*2w}&*(dAqaogR`cFm(=I$w<=IUuPf+yzri)6E<* zY9J+bCVsHIPrE0asQ0Y?i)V#m<_YYqPe*3W^Ry!PytSIAiGA*k?uhF70cTMAGaV@U zvl{i#5eK4vRV>QX8Gzm5#+O(iSM;$e+uzKibU(uH4}f?~w|xWQSYeAr4bZrErNUY_ z3scMzr4fGGmsO4HfY5>%3iy>*bfFSJ<)iQ!8+s=!iWP92#wm_5Yqryd;u4qn*)vvB%p*A@&4=Akv+Qw z2diwkW=ME#T!r|jD;lny*FWXgA2QZ(I`}lf6@5D6Smp1u-zukX=xJ=eX6TYuIVW`I z)K|4&%d?oL&l8#7IcRJ$RzOvb*@sBQB>cS2Qg6t@A+o4oJug2{zKm?SROAvroEIaLZ1+2oMFf5G5J=Y;V+&>oF< zryu^Hz>}KHGX7H8D}77kaFbnauOYaydA0itsd?PqllQmgBEOo{l-%zOr1ElJyIxOm zyxv$%9lprtx9W77$&rmSPcqNf@fT%zsBuFbGrT^tySzM6Jf7Za*K}XPb?)u@5a@z% zXC)p-87nWSC?}jh#=#0kz=0nQ@wFZ7kACnwK2r@-NffMqb!u|6xsssn#}|r`KT-5` z{*|Xof8^7pnoaM9?m>)=Y1QHn>DOB9prY&KqBywWL1`(MmMnSdWC`XOrV1_?q57rL zEG{&lbfa!W!hb$V`nuYm(9WQ&*b_x?P&Qb8mqt*-kh^!hlB|DMYKO_)`}Xzm;yq;q zT1TBh%_5udYOG|ELM+#z;u-6&sfR~zh*g`vNEkkxvZZzUtaqmV25M~P!EN<$PC~F9 z_C~MbpeHG-b#iedLR}5+9-&qBc*%K%+Sg{&GCgOvwAIME$YkPCocDZWBMB2x={vbQ zVY(+o?#_l?_So?BDg|bHLM##*a9Hc~46_U}`-qF%MVDZ44jnPI69)O1k1Gm|U#gGX zU-Dw8*nHKqu}jG*uqI?g`i}NmW=H0SGh!!^?t~^75~e)Zv$I+kiiyfzcx8R3?a}<$ ziD$K(N5a;)$obxRP9I(NmTKm|KdE^2EZ>nQ%urnbZ+(h%?RqO^SGctpzjP=9$Gyh+ zBG#`Yqa{hH`tria#PEfO?g!iElI=o$!CZa%I@1MNO%FyZZ!QU^`OVl=UK}-2SXiX| zTG13S>2nB`<@lQGO+qA|G-^aztq$U}c`%u(1kg@oAd8E{&)~O34kf)V^Vl1Se0;Bw zUIGe3-?vPnn)}NSqWlNcs|*%Csdbc<^a`-2e%dg=ad;v|E@x!TV?p_4V|Q>9&vLLb^9~&LbS3;W>T3Hek=P? zc4%i9^qBIj#$@;g_l$@;i|(guSlQVWuboPnb*%UKDaK%@?6OI3&)f%90)7?hD)?2h z7Z{4p`mgnc zX(N1>N(i6w3pYHY+7-Po%`j>Hb{p2zs1C0K6BX*D`HY}lw8y6ure6bEbp5!tZ{6P$ zrl!lFTPgmQzTUG>*hg4gUUI~~5^5V`dnZv(!cN3VG2p*9D6U9H+qU{IwS0dvVR;=d z>p07oc4~oLL%H?!6M?16s)Av*6QS)2eJFn(#iM}j$OC9bR|wN>dc$sZ_hMpY@-S%@ z4-;J3+CzQ(eo-PLLw*(epLki%#Y(=_vgDB*!c7{jnEBY$7`nT6IrwY_%76FvFqag? z`QxQ=xo^H2->O$X_i&|gZt%eT9PTeX8U*9>tQ`bml)G3+cDqnE|C2_+x+O24`Pud1 zxF&A+32QC?GW%iA)ceOHLQIX;rFtqYeiTTX;`7Na$H^amoILjJTM6Tv1Fe3@Hxl#6 z(fhM33p_R)dY3!qdwBD<vqU{ zciGSENTtU`83<(YHw(>Ls?+Ejvj4132cxAJ@%185vX$E;lZksQR#9GBn&4Gd<@Cq! z^k_vpM`-a++u

s?_c9;L_ng1F8Cs>O~xd*&;VsA3%DPPgFiN8 zAOVTI9~RUADd$QA70Qv7FJ^ElW(V(_%u+3@wXkLNeAWZOl=qDXe)AyM72^`F10>RP zwEPXZboP;dL>-J+M(ZMZ6YReD^YvC55zK0U?O*rv0@z5$E{K7>cEsf%ZI3#0l}2uc zK<dUuR>uMSA|UVE**%3O2)=5Nl$OAR#z5~7<#AP|T|N%5f; z2n1FEejX6u0e9%OG+clWTw6I+IS}Z5EHUN@1h{6hQq)off&AD&py1~q&_NDHo-qPGvHui-A8ei9pH~n#|Is1>{P$_F3gXJY-ydMBk(s{w z1$+>?DjIr#K*SW-9~@9x#ton~Lwg+qPXpD*5>_rSz9&yzEUo!`V6NC&ASoXS;4949 z^9hp=%*ok9!bh6<@(BsxJN7m|Gt=cGo{rMY2C5oN4_w@>nMC;R^4(>YA!1@;l5&4) zBcb*1(VyzTl{B-Rr>Cm~KfkxPH=nm4pNqRKzks;7IRD*y{P*th0#ERI_&R$&@!@s$ zxbwS_zwJD<_ONodclES)ac07{`^3@(?kUa8jD69+|9<&*#E-kb-MeMI)0&*VRwkK4-YZ5R) zD?V-iX@-DFLq6D|h={c0_j`cHLsWDk1+yFc*P zIQx&72wlAR`K@xyCHq-j@3!>H(P9jraRFqEA49V{1rH(`rI-4~hiO zg003NpUJwfbgq0OKF=S_FXEr8*+j*K5#?AUB$T$2CCTbY%)il|b)s~NC+DaH#OaM= zvWH_)Yh*;Xu`T6OOka&>b*1$K#)mD&r=`bphdg%n$Bvyp!bvWyo$Jpe4>GcZ%^TOh zRR$xIq{j1)z~)Uh=ENJTFbmZR9gKv_p&*Na!{HpLuZ0Z7Qx<|D#47&CsRZeR`NqXb#LBft%6O(5~6^h68)M6w{ z`rMg=_U!a7!;yt}`@Yr;g z$V)d%`Ly`6#;7tydvp!lALcs!^H-Qh!^!Sh3}cz3elF_)W=|5K)7t~L2Lr;}m1-{tMJ#y%XxnX}S4P zzleb!qS{Q|)0yZ7Rf@xDAvdeP@&5S`X1kFlscY5tdSdx#_W}ONdt_*KZJVACqS;&q zRzA*pesJ{GnRSDFkNsK2qs zfho>XvtftM^M_Rd3AJSr-O>gxDso54Uh>%~&UPO$Xe>>m*^z|ce+ZGWj#S@R)UoF=BV`D|;j@F)wAdS=-HACd9 zvIVr+;i3)x+NWzDy8{Y2?!epXa|v0_%IdbKLS`3SW}K%&7{bVW=`8BVIAPoPHdi+1 zy7sri#+Hl7G?FO|j;ycZD^IF1&bCyCgc7r$)axX_EEiZjYI~kdX@T*YX)c3Klo}j& zYe5%X=mN`5cDlXaZ!+&*VTF~u37;QvKnnQ`vlEJMeCc znd%Qp2oHL;S^i6ZwHIAkJ>fDYJ@#`O&Kb|8-h4Q2SGBZiRpQjfh1&(84st+>TlO66 zPzmrV2^p-s1zLQ@RWFJ{4hj-vxXsBY+tp()*V?(z zcZ&_d`C4X1=Lk`nq)B=079@gdU3z@p*ErBlf>0Td9sjD z4{(alOb=DW_z#U3y&4jg@}Qq!$-_D3q`id8ad_rItu+=8S)(J|IH#jmlQw>B#iTsmC4qm0r_i14YL zeKTVF9&~8jU2C}dv11QieAcYHe*fw!&8j1clx5;R`D*=ZZw%NfYl9#(?)?MluicyZqYl_)NGaR`R&S4f%PAb!ck?G+Y|lb%hp8l%MTh#ecp9O1t@il_cLw&b$uQ z3yc4hGq=gfE}ESf*eS0c+uR|sESZ0&*8E=N6WCDjd1Sro?3DK3=! z;-le|emYn#BqCIpBuoD=H(&E-X_%yuYkuCsh5+XJ_KIiLl|M_6fILY6H(ltIEc}JQOd2(+k}@TM2vD5x*>0#1dpnV zah9{bov8Xag&UHLe(!knU={|;3mVUN}<{2_6&UU`E!du_!@1m4_NdwFxIxyG2k?GW!&Pl?0{ z)%ksBpLN$wf54GZ+t(%=IDB$vlgg!`QhDa3L~=-6Xhv+0n0Sh&#I(^Ok3%Y0&MJH_ zq^#`Dn9)0{ZWB3&Iy#LF&wUHj?pKkKu7W1vb0e2BKGn=G4gK_iLANh>*JJ4OvhlUl90CAe@nEg=r>q%pAm=#A_u z1tv`#Q_keiC7sWnTZAgm3BAEm3G7hOjQII$f1Uk*$e9cxp--;;9$H&{# z9&tj3Yk%mF5CT9$6HrqB%S)&QTXZV@{O50L4*{}79#KK?x3jLmbgP9b{B4ctey{~6 zI9&d3XM-u24BW3vG5=*bt^to<&82b9EIY%_X>YB(ulX@HPcKZCp*Tp-Or$#+u z5^InNqN7{2Wry$M%%xlW_YL$XYqH!6mo)bcIJXO7i3-xIH&8I-a-pa5WVVhWuq7%< z9Lc{#wF>f+itcX7ywk}NzgU#_Xg(ukhwWPGUj*Abt*Ut(%C``@IQ#{--AVjuXHlsV zMU8Xr%i^bW3j4`C0DM zCqslQ?CP;Zwy<|y*F?M|*D#)03zXKwYxjRgX8C)iC4XNSqc@SSwj9$RT-$(POQJcKjeB|^1pALhjuR`Jj--j^c zqFdWR#`=bLwTfmq@14=9yzGVMaWT)Pg=tY=&SS0-U)GI6iP$cE zpl?#^hd_VzPtY;N9`u4-^%55!RX+9>!!tG0D@yS~uX;K+v8PTSLKsn zZ(2fP@-JDzr+6l7bS?+Vk6!{jmkPKnyhzJYH>oS_bL9X@@@J#Bj|raR4x=Bu(jo{? z2KdveR%4iVZJ=T_;XvhZ3Z4HS#R5$S6bVX6-Xragsu)NC)S8v^kH1_h3}88j*{FK$ z|L6{=6)@k?_3vrGFNwapPiU9Rj@q4&TnE&eMtN{P>45(~3`+aNLhJvBXNA%Mx(}sk?NR)vf<_C_hclZWA<%E&=`9vFchY~LZ*l8p zlsrZ{H`UU1tz2-gUz_)0e|gt~9G8f@6}VSoWR!GS@LL^o)B!EDailmY0)j)qDCU}N0*2X--4HvPpBmSVAJn{oe( zuB($l2@~~;!n=FjWaAe0w%xHqD36)Euc8g-uIX^M@RtPdxxb~3(3`SYcz2hM_Xo)xcsW9 zy7XMCJExe`?@n9+mYKwfa)TP5bjoVDYtNQWio-y{YW>xF27cnya{r=_r5IBenp~p< zvn__Ca7#_R-{y%Ka$}ypGj93=VU7G+6U8V#zE17*6?Ljc$E~@GyIs%D*cEVbzO9Me zeYR~Z!XD9kX`FG%?EvP!2&Y#f_03pn+FJ?7x=qu0j=hirBB$J`QeY{?F z!aik+Iv&Bqt{OHtSaNC%9;0K+YLm`qU(;e|2-*b5{jZbJ%tqpr;lW(FIbYJ0n(dp{ z6E5a1#JC7REq2CzvqF*e3G3&17Wmk?3DJQNBxxt0B$3m4?EgMHTn_mIJCQ8F^4IFm6;hAuVQ z--v<$SgUaPdj}___6NlR{x8uh%vvg{qwMaUA#q)jBYkx8h~YGI4rlMdn+oo72vZ1l zw+Z*>Ccux1RMsvgL&i{SrpNFa60bDXfjmydN1H|m3I+C@e^p3&cjZ8hrRicy^+qLW|VQc#uX5D%(4Wv73~M7?>9La46sEn0lJhVeC+=3%rBVVsQBw>40`vYQjK& zzv52hkFd)(SmWUN*w%Y-C8*-0(}^J`nuXOkq9>ZS{h!^puT+A#ZZdGpJe!iXnN6nA zDHNu@gT+uwx&Xc^5MJ#!%?(*4N{LI`G)5YxC7!;Wi{|Tnn=AfyQd+ucozP=QbXz3* z1f$DaFtDj+Gvk+VJiC}h?Sn0;{b zLKP74X+8>nE(Sf;`8*a7r~sOy7F>>EQO>&>TZ_V z6#sB3?Bt>nv)@rhfik^A(Gr`;^mM*D*@@g8?PkNr#tk*JXHRd>*f%cq$!rfIRMeKg zI%+i%|3HCGUf$k}=A63`shmWxqzTMpEJ`o0$C-fx@;Hq}%haQ{=W}i+n=oO%&2rz# zEoCA#hQPg-ToP-ggE#W6VzVsynqBoiLV)>{+3V|lRLjG(tZmUUBxCd9?DO0wt)n)I zSb`n;<~haPPW#w2Ie}Z&vdhYksl%M^8Lsnz{K&rEDGCH+>ZJExO9VJy6Myq+Xr2vQ z`EWJv;RIBPa|759KEI|7Z3aL6@=JS}+qzl5PZ!m&Vv`Z*u5CR?H*GCgIq`06_$BIV zUlm?#lVXIp(~`fXc>CMr<2=W!jPo(Vl zVc1;9ZtuC|5ZOJ(fGQH3nkhPOS(%yk#{!Lo54D^ zmN4qt~Pp$_e0S#ajJeB#dakwENDbFa+ zy)IK$ajGQ^nD#m*We-744lPig9*e3-(R*bICyhMr1tBq$w&95Y53%Lfx8E~wc(E(r z9Hv+JrU!8=jAI9H-oC^awpbW&ufDcnc+1}@^!QLVh6tQpHM<+?J7;{Ls#YX7>ma99 z@^zD&jI8gr)I_eCqeU%V1b4+?us2-&#MC=g>X?$4O8<4jH%>RZOFPI76*XxKB$*Kr)bu?B>N~kc)+ynM8B^x^BlTsCdUKCHCr12n?EVDM@RG*l>+k|gRGeezFLKiliT^6rI{Sv|lD91HoJfB9fNH4yL5 zIq~Esj~*!!=0w=REB0QanN{QEx$K#0*2Sj9U8ib>EU! zaT3gE)SUCYs9>Nd&dvASwURF{$%bJTK;9fIi|ejkY2qGyY88&>?#QeNQFfRZgl?5W zl+~1%htSI@zouUPW&<>E0d015?3;wYY)#Nf=e4$|X`Rye_P07c9_1qsM-Fz zTGb)^)N8hCsyQ{|NzWzJpFQiSl~TX=kcl4)%!)W6B>U6ee0M(Q-ykG(ZH#}8u#)PD z=xDOpqtKsRtdzlY)sf0Ii&I~sbB5pO99c5cC;24c<0%cSqqI*si`5puQF)UH9)cwm zK&c7oo8zkV9t$@ey3+BW%VW}aM4mBu{h^#f@^Mon5S%hzkN)^P?|=bOp zBSAv?=#PL>{)(HgzIN~AwlEvudi=LM#LL+ysD24-v2-1wf|uA02dqal;O+^pw3`vI zaQ*B7JmkDNnGcwwHO-d{$zivHp#r#Ber0!j$P7_sRX5lZej1YVuwLz3Ah&yn@b4hs z9X=u5wWJYcaQ+k!Ma-WXP`=h1DdA(roXPUmqY5s0v zxSHskSFEqk2!)&g7M8a8TG#g^z_LNLk`uOHzX%#7-PCk+XGE__VZKwesmB|#HaE`x zEXeeXF?8?W`4roWbL~rL>qR9_zrCO=1?Ky<7#C-u>y%Wb1H7X1PHY(|nB$COS)liH z2kfy)QVUr{1Z(0T;=s_e*Vxn=UKP&avSzpSXq`E+Y{OkB5vv{MbvL5{ZIhwQKI6%# zRL-xcaf%Qy0e}d)zKrIv9`bQZHkO;njAe+O)qUCQ7U`Q0Wj)->8d@Z~Fy_?I5}<-| zu3;1jC;>QMR47b06Wk0Yu&6}r(`Uf-Pa8$g3S9;k?)8d$zu4^CIIAh%WxM^F9p|ih<1na* z#1kW+ctWR<=C?;VGzFgW*K-Kh;_gXIHn-b5e3!e`pi+L+F-vlCuHQUo+`uvZNN%h^ zCP??ENszanbVrP@R)x?&bC;TFV0QC&uACO> z124K`molS#QAhOc6PLirpauOF4ZpA^-}m%|_E+ACizx0iUJVs(TpK!}|H%K~h{QZh zTGtCAdD6ZXlw;<3Mx)Hge4?Q_meXR^JzY=EQ$HCMIJ~LW{0rbAA9Og82EMDcw2uP^ zc`y868qkD(17u`bE=a*e#_3s$1*eG!Yy+HkdJ=l)jCb9|WHC&Sr!fae8cHL}4vaMX zIdUvl^17wGW@xT(>acW|j~8vr!H*{6X$owv|CBTac{DcbW4wl*cWOk}d=;;Q$-pl1 z_iNXh_b{`hG(J=BZE=^sda$C@TcFb3BJsaa217$`t;21W+0C)YBuH=2NK&zyc zaIVWczulo&@GUgwdU{D*)&|MrZj_me&dEx_vY!Wh>e>1`?l937Nf$KRxXs&uu#xnI zCjLV*L^V2;emPInak&Jv&UgA^lVAHh(8J#qF%aZ%TcW>)lCwfPHNk|5QmVzxjhthR z4ps9tmN6G1`O{n;P#s!t*icmKWm+1!EhLABZpbrf{WOohR^B|(3B5dvspceR2%|%9 z{Zds`=sdf@#9?;m+tX$=hn?o&-0Kz>@|69}lGPLck>s1Ks7IV6l@|%s<+GyG21+Q6 z4dSSzjqd0!gdR6URhf^mWlF7o#__NacDC%N+LZ+86#Ft6ENka@Jlk+f-^J%d)1xuY z@wU6mYr##?#}_18E*0z(qfD%05JbR!j%bC7jHKka*>PPf_xSjEflEi1ip%Shm10U% zsiUKJMcH7`abQx?x-$Ar0iA6 zWPLrK#M#-g5^wAJx1DUuinfRX)z++d}(Z}n(x%0h@^i{>_wk$3sV>9=?L>W8W> z^9Mus@~nQ$6~sxZ{S3Vzx3j`&Sh%Nme4hReOe$M1$`{SO6Ytph_1+;{QCo7L*4;dp z7RQs>TQd>?lB5NN)(fx?6S2FdF zw*3*CXZxtF5`N_q=3IVF2YEfwjILsVSAmDk*`oc|pa_%Tq&)Zd9zHjh*H=(GI+8fa z3MiOC1PF{GF6>rD7TjbnTnh3nN_yqk>lQE7026+pxOkdio2O$xXAQVQ^d5Ul7Wxnc zqIn%QIIWL~_tSmSY8zgR!ECFU$1OHf?`nDrQkS+tw3pT|g1-Duj+Pu|Xq$qI1= zNM}Nbz2C04m82)eHQ6H0x@+n^V2`{Udq}qQ2u%-tc=JXAPZ~97_M5n=agovu2KSLN z$|KF=-<7p$%kkVC8JFL-Dh9bYs1DAhr{B=l@8fhGyunKI++H$Kf1B1QpGh?+yQ?3b ze!8l+mSG|ee|E9mIC#LLu7Jfzt7@Vq9)T~nkfMsFoCTtlZ}4LY%5)4*T)M+VmC@o{ z_ODTRdK;=LE@lmB^4g&9aHJLIH!;qDQ@#4V7o}@N2|iXx)3m9~VduoXBqC}d8+CIH z2ioz?u7WcmXP0KQ*n^<4EiQwzOj4n&eppVx88K(I39q7Zm$?-#+&aB+y^nWn#EtLE zS0M;dF{SHqNLtstcRGIRBTRvtaYO6F%frKiIi@pF zeYE&moFyw7XT4WT?qy5#1zVck+f&kf=V0_fcJl()xVG;e8`8MoHTjqLU?bzbyicfa z#XsgM^|ScCucJ%nGF5ye115g0@(g*kg;O1Lhc$~88b1!A39NW)^?iE+BEq+AbTA^) zrJ~A-qUVR(uu0j{tjULRl$z?|$yd7ciZ>&G!)rEQf7td6D~*&7#`GZC!mD|N z3C4an^C`L?KR0*u)p@;CbJ!BlV7<`cF!gZRw7c@B$ii6J)rDP6L9|hV5Hh&gjax&D zJ6;Rr-hlZNfCXSrXkPWw)Q>ukzSJk4+nmvvKReV5M;sBqXkm{&uU$qno<0WHCo3wg z;cs>CY1VHJ^O`2)Pj;sZj~gSkbJww0uz}1G*h>w-G8JtJ4j6^zg*-QyyN82fb|b56 z7n|8si~Et|Qksj6mKajH)=GXoV+Eogcl$4+7k}U`j0M2Ubh;u10O2-4|OL^mNh|jBe1#p0wJx`tK>;3 z8k@E4>b-cE8nWMx6g6*Wlpi7LCcj|-4N^#B>{V@CI2fSHT`(>LcG1OsLRd*lfa?9V zbG*cCw)80FhM<{DFJ}(GB^qV}qA%&%HZ_C1_c65oXQ69T%Yt6uhPokuhk~@dX+}9{ zNvjegR*ACW2u8ojwD7EyPi01}P22A&a^(jTCkUZlI6p%InGG%~LEC9PgMezDT^I^TcueM3g@la=(UMn!xfDp~WZ82A0M-d%U`HZ2K$4`wQ0RFON17J9>uHw?v)q*9vO{PVyCj zdifdquW_UW8wGiGzj2+cMAgFW2A?d3>8^+BLv!_>p7Cy|bl<7b)dv)}Y;B-bMeO;b z8L>iTtMm^Y%feuSJ;3W&-`4y`pXjOQp*vcD!Ex^SOs@dkz2WWVJ^zpDK_<_eJB!85 zl|-+c?aAvWru{@YWx;k1YrpnNqAs>!8`N!a&jIgK4H}~Ay6Y&(r_n$1PRMpNY96$; ztrylT?4^NJ<6GM{HC=Fq);0HVthr1w&QZ?xZ2}3!1Ul3f>%m9k&to0C zydh(?11}?@1=mG9kQ#m-nNN%(G1lid3OAe$Zs985#1x&P>eFpcrs^=h4?!WL#2gxc z5(cwEL~cfH#%&l4%{7EFk$m^Ui94T_g|)EM3w54vHgeAv!&Ylnfw&eI@j#`{1ly3~ zu+dWOjiQPMhjz4h!-vLSWPU@sOu3Y1E6pJenV}pl{;J1C`-a+*r zEh{pK8z#i=ou^F@llD*WIp2Ox%POSi73N3mh59ahin-Lne*LR<=)LdVu@{G12bzeb z(7eJAqYb9R%{<+;!Oq@0iv3j-Bx9sFDNTRwy8kGmCN$< zgGvHx8_gQ|MVyV#cpFFaEo@KChrOKXV?R>^T+<%II|Z#Xa5WHP)f<=IvngRTb$B*c zOOx2AJ*T5Yz(k%MT;`lPhGP0|H1?U6J<~MQydr4NzCA#tS8Z4}q z+UQpr==>YUM^2VPS(kk`b7~T4^9vhnyG4ve}HA$U8|Y;`w58rC?p$VHP@@>$7_##up!w1_-&eqL zqTl>CjBSQRdtK#Bm=^iV;f6=O5>4huaHRE4_lMmRtREg=<^*t!XV^+Xv3}-m!X{`- zr`W&NffaD!^+tL-|HjwR0Ew_4`Cj^ui(j1xSOQ~RQTA7VD(n*h!FBHT1A<&8L~5gp ziOknhqp{QvU&UE~u#_njutEPR1kb_;(23XCSAz*Cl`k2j%>O1w@jr1KR1bjKlsOFI z#JGdku>?t{2cT7fz<9_*>=>DQZsCS}z%nT-#Ysv3Ibsf&o1a80dw+=+alkVFr-=Ih zOZoqzVL*k;9z0^Y2KXiaB{U0=8^3d>5c9wc{t3}vzB3I-esaK)AOBN%`DJYK#{L&W zrq`G5hFTUDK6cC!urOmM?a2xg0j1vMq@e&zf-U%+v7q4!3?WqiZUF$NFK_i?8Lj_L z`G0Nr&uaWvMo1g~cUQQ6zJh12`MD{sjSi}Xt97I3d}8QACuo7@DmcG`SV#~ zuj9yMU*)og+Ow}wo6{36^*cJV3qo+M+T#I%^pCH4YiCn)FgJjeU=y`CZG5K={**xV=n{CbJk5-9%#0VmGzmgb6xoF z1#SD7nF2%$7F2yn2%eqZ7qnSY69i6q4$@UO%bh5NsOwbZJ`2Qb>@dlt&*#C)bCB-WZ1HEZedW6&k#jpg$A>^^=E!}9G`j*QM;2vuUOOhx{B>sug^ z2vs6^&!G4zlB}=NqA2ul4>v8)`S&vwjPwh4l}9zy3*#ZbF1Hs)r?H+x; zY?am}@n4i7VgUR5O@mb(V2csq;6OyRDZue*mc1&4Y*!5B`-p;;xKXT zsB+F9hY{r%f3Mf+&EQBzsQ4eI0_UwFss!FyRuudQ*6k}6Fk z6G(tb|ME|3@tijvtM3L~ZMrOG%yl;bW}hZeBw6W+^-uG`9jpgM+~U`ZaJVVZ_1m$5M#t?LG;njz0AJp>SW>D}WrmE&YE9ix*X(P4ooDvX0v zlyImCL!^K$u>5|MLl9W}*NE0w7)?f8JALMUmTKE>HpVYut!Bmv#ZpU;R7TmoSEU93 zRHXrT0yc*A<)2`q1QVK!h8YRcaf<4@_Q#B7x6DupL~%lTN@4Yhvl2;d)4FX2sfIZ1 zJk~W195=A9Xl^ZT-V%Ygt#yg8!av*3*MQ&3$7gYJFBOe38rMA5@Bdn<)BYhe1IQCx z&V9$hhOP4=cq4QOvGsEpWRyRe<4T^}s;q?6Agah$-zpZnArR+$ z3m7wEOAy7xxyB_XOH#>SZPu1R*ReFpf8yio7;oJ1A4eZ;fL+9dgX6uQW)%4WXW;OM zi3)Iz3^#{+`9qr)SbmWlh#9qlwjb7uU-q35XAH91-@K`O@z(pG?+Y@C-5ZsTZBHJ^ zJt(ph?mEV*VBYHkJ~{72I3m-YX)V4HvOE3E`!TfSTXi%s0#Bl;{qCBB#IoFdCNe;= z_!hEuVRNi=nOrBL_H|<=*gb>lLTbEI1Gd8W>k6cpUlRkAp1YS5tfa3b< zv^FU+U*iOb9SR7)jyQi#!rHQL;5%encl#%xYt^aQMK|wqYBU_Yn0jox3YQ})0u$fkaH=b8 z;5>sbos=Pg;0LGZZxF22fU-d-?{adANt`yRgspZ5?r97xKYFFr+7?9c3E+Py>3C_e z8xu+O^9tK?X~;CLGE$gL6!#r)*65Yi6Kwk8YfYRn)`D->IIOGVIP?~9?F_k065a0u zdA^=FkjLz***5vj9+9;6<$-sAPXA7I1d=}hpX*ht(snkrO7l~I@LC4)Ruj`J{=;$s zNI8+iC-e_+CP)A#>HlBlS9zruFAX=ex|RC^_G0$u=kIWyXv%SqW7!mRMAL0|dg5ze z(gAES>kzdA__f7gY5b_W<@9j(V(TyKZDg2UWkH{gno{am_uB&%z;hoxe*ijZldZx7 z^Hk93qr{M4)5j+Fl_oFAv*K0%FK5JIQ2WE%i@gK-B04iki3Cfk0IlgF{K)qjlu0-Q z$=-ACbOMUlZJUBYE50^izLo&zBqzm-Sl3>k(xk?WboVA{^WP;(nsuEU*?jz=o<<`W zXBJYbqXyWNZxrM1laTywJjlBHO^=T08fSS;1j`i~4!9xRb+9}opk@C-bpgT%Ed>*$ z_`Qg&;N>EQRk*(OT@$Q@@N%8Y;gj97X}NtKhmn~>b);mW&$`RYL^2y0Mp*0NC-rBd z^Hg967TsuAyK@0Tmk}HqmZiDa^Y+k`g7z+F-HqmKfy|Hb+}gJk{Fa5S%;sifSAlHZ z6Or96g>n(&xd59B5}$Br8z8sb2I1}!*d|(Iyfd77nm*eU2C(aLzrqVTweR+_YWShf z5Fd(GJ@`D(&-R!xBTmV^vJ3gyElx3y=2mLuph(sA@qO0=ohbS%mJ$}AH^^-zrV&QRMy z2I<+>2s$K=gfzM@_4)spmrq_592(I)nxyG9Uz<mi%5s@&$m1`mZY_iX|Dm4U5124e%lUtmUF&!CqKSr6j`5U$_8NoiZDN^T} zRUyq2!Fg)_d=dro)1EObxRZ~AOBNtJGF+JnvvhXTma4Z);{0G}BdFzvB6jM24^5;$=6aK2}j z@TO#FuzlEs=WHmDUD`1C*wj6O;VE#UWzFxQ>HAf-^s8lC=}-D|woL|kITaL`qyY;% zShf1)x2B;L85f(6E%E2CC7Ti4T-G1TG=d_P7K%uOBI5G#2*9i;wrdrt|{`A3&gJ%=7=4|6V>#@p#FA(?Z#Sk4^N;GX*<6XA}#>dL!Lw5F>9Duj+;A zig9DUt#KF21L$%T0Exu3R0Fs%2bKQ42d3*QJCSLhOdj)T5cR*UZrNnJ>P%Fs{+x|1 zeRvPN?#^;sLkOt%ZiHhMs5e11fO+V3UqRJOd~3zgOrVyE1~*&!tp@8b-;dtqgy7t=AwB}5B(swq*n!W3 zo`ETv8&!8K!R#$eQVLA?K%3%)ERlflLnsH961@hzf!yvHlgAEJ4nk|njmq(=c)(H4 z^kLkz=)SJA9Xvt5U*Y+-M+6kOiUFps4u*qGS`LOc-A`q&-xW3r`H@TuOjeH$1Og-} z)lh0wSgu-X5y#u~kQO{zwTuLWPgR7rrwiH1mY$k8g{N$@5Dsk3UZ<0zP=s|S|7lF^ zEn72jk1X2ih2z=amwe*c5v$@97I@nkx;H+{gF?VWd#aeiiRK8HiKDSS^)?*`OkJP% zp>pO&f5wuta_S=0DJLtnLSl6fj_C6POhCM9v2M}Vy?J!|bWr02`huXUGYP)xE>VKX1l3(w(-A|})Ky}m6uh8A z^BYH-u0B1{Kt4=;5f>3)Wy5JS9Q#A)ZN7U`Lnt0P+qn(PCsQq%4!U*w}t)SHI;z8C0jH8j6Iii7UXw;dup?Ease8^3 zDr+JZA+s-e#UX=Bi&4j=Bnb`~50t_x90{YQ-|rWmPSa05p$p`C78g}Xa(^RRPI0Rq8_O+IJ^% zshgb+zt-j4)b4ks+aG=-B%*{=NCdMckF??MIeQPBJ1fCr{b!_C9Hugmx3|@? z@bb;Adpkrw{z&w$a&R#>Avd1OKQ#HA>~mm67*CW60vXl4K7E$Xw`D_t=YBy|c2yLc z6Mp+R8YV-DlJ6@Thm!^}>2HR4wwj#ya?=-|BK?W~5i6WDIyeIvjtxIwT2Ng9R5sEn(tmC6w5x!@eWEjwGud##db$ z7QS0%pMj7T8Lz7d{FL3jPFR=Q&)lZ(cfOZn!hi{K*l4|1e}F(jmVsk>h|Ak;^xKC) z+;QiRL1Vlhb1$mc$h<^C(InY7R`7Vj)lT-*uP;yV<9-wF;|2OMq@2hG@)?u#2#x2~ z7Nvu#3k6lt_ zpy@ARxshHEtc71rG#xmXe++2i7(2RKev}a|)tBlcNrl*z7ZtjLKpqeb9&G)L6VFz^ z{;WWI=45KJfC>-6!5W8sl663L>T6fRdA^4+m4Us$(s*Bmf>75xvVsNUd_#tZP+?E} z((W#g(o5?ofdgGldyWcq0>MI<|3x6ydHS`->>Z z1+hE|$AKZQI^7Nc=7?zpZCASe5kG&>QNo06Af192*wNF>o7oZdzrcj%296Ue74iOj z1d@SyJa#;1jjFqn`a+E(W=7zJ4s}_=jz3nTEV>dJ)??8mQK;qmJW~=snajs?d^uu< zw%)nJS^*)Gl9Lk8fzoMl1Pf-$(fOloIXUGm``pk4oFWIMq-X6~F1^;4zBYKYPqtNC zZ|_dZT^tlm9Qhi{ zg~45ftG&=fBuWnR@zH9cIj7(VrA*#M$4=kKuCab+Tca7zcvA5q4A9u^{B{Kc9W+ag_aV4N(yC0;2$C})UNR_3en z$sAQ%F9~x5xw`8KK-Yzsa>pXCvu+=3+sf@Wf^cZyVfog5we$239aYOBb_7Mg0|!3o z;#G^K;Xqo5W$>R7C={rPr(h9C*9`LN6qV!j(?)tyo_WFDXol|;SL@Pu6Jaad<7(6f z#0mxjfv4hxdHTNIZly;TcuzbDV?EtWlU z_AANdcm)%c@tzA1ebY#~N*Ae=l%T~D_`I^=y=27QuAlxBBZendv`xsXv0|$-f;HC} zMa-H{@(CAeEjLdUtyu_7DE{%!wCl~Da|!pzWrx@N9BpQ?6}?_+ih2_d!c>l_1rcqW42dslLO!>@^o|qs#tHLir8zMDYedO zyYsg7Bo;&soWS(N-ePJ6v3)43%Ud$vdcCU9V^2JGC1xvHgjwD?kjHnEVNmX~x&bY} zz+6P2X|ZP6uVwIA$4)6oU|T!&7l6@XjbuD2A2NowcIkUUTZk}|isF_F#|QS+$#E@DlZwk zdwv>KSa|#?8B7v$WwH$$OzCeZhhvkK_HGoLU7}~ps@F827Go%`W^M@F;e9Tb8T#+H zKcT?Q0FgMsx}6bZB=O+OKM0YNEAj4HXnHzKR0G#0+5dX3d{g~A@SeXEvc^OLr{`fSvdD-ORu)f^?)p@HYq+Hw=iT8JizqQEfp@t>;O**u#?qz z8#B!6pbajUGt<MYP921Gef@l&80AElS8y0zW(FPGK7M#=IQ&QhjY@Bmf_w%veH_k0uWxt9lMC1Ji z>SIZb=g&R&2hvnDd}6Zh$;@DIC{L`&cr*86y;*4Zayf3#8q#77& z2Mx~}fgaj^)FmE!XKf(E$HBj<51e*{+8$)?CAO5EG46A5_f`hxzjI1R>XHw){RY$1 z{|upvSa6DKjg*SlgN+$2=FB$E{#LJyfi!N6hPn?St_~h3dj9>uI$ z+{K?p z79Al;y^jfHO5*}`Tl43KQ1egmY#&d4R!+P^v}d!t2klZ6N;G86A?XfvXrYORS@ls= z9?VRX0M$ryMe)fO)RHB5da+jLlx1OGSRW|dQ76s);O+voVg`0yQdbMZ`$Nea*>f3!Qb=uPaG31y(MT~G`s+4=^`HHf zq!qVFyE<}5G0ZKc5Nj8&PUt=`So^qe4C;iTB(~6|*fR`FaG3|>eF83X3NR&bGVZh} z{filnSs`K3wGY>e%$*IxSP?+G3T4eY{t31>ix~pk-~TdbmY)qZdxiW{YZtu$T-qyB zu(I*f!ev^f=|OA$=Y`s7;#Ty*Uhy=jfMcP8;NKn7_WX#t_Q`;?UltZx=}Za1*Y-Bg z#MSj>?a{`jYpoSGJ~d3Zt{Zq&&AzB89x_&2&LD?*9hM1QMHHnE4|6OgLpY^)`EGli~!HDvZ+_8gzWq4Z)s_FQ|ku8 zT&y2gc+AkY_GLmG2HkQln~04zuQcX8iy~Dk8S_uocMo}LmdsTx2OhHpdz1@a`vo>O zNVpuB7rItFWnKr|3O`k2^#}IAkvAdtSZ5we5s4;}Ap(ki_LNIjC1Wiu1Edf%Q2ZKP zY#o9GSsE5NNv7N%=r zV51edSUj9I^(IJoDRIAqS_Sn29zoEw|6cMYBWVym*T$=WF^O|WW406kmK*O4;ZOm2 z=~nhxYp4%V%6g+arI`Cqfd4X-FDzujR@Y6-+tvd_HUIes7@c3_KGqYbV>6_K6J^;jKT+|7wQhx)1O6HhR6!g#QD2di9E-Q2z6=m2;5IpDR*LFNQ8-n z2bmk$$_3kn&UkEr-czy@o1K$)^L~|mudH)+psRTdO68QU83>(jeN#~eTVjYTw{BqU{iiSMsWz)7yOmA7 zB4>NxJHz1(6q?ZvVR5Vnhk9cZ=JoVJBSb6!Q`(aAejOBD1O~8>twz{^ocq0+t(IIh z4$Us;i<*TmTm3l@BS+2k?OJ+o%wD&Fh}d1OcD(CM7X%etpDh z-RkMWsIVc5;?7seoq6~Lbi+C=I_8Os@P!4NFA2d`V>%4eXtn$fs!-9|zA-)PGbWHf zTmXQ6p~>Jk-4eHeP8qOvRnUD*tuVc1!kae(Gu&UOEFXT3;u~Y(8#%gDJq|2DnwocQ zTj*}AY1H90&yQ-gxx#Z}d|qtp)clYtSL?G5kE124jVpC zj=zWI0Rth*G{EcI=*h6+*=p%2SSq6uOd?h7CtrkHc?kyj`J0$Ci`HR!L@IeDTtk%1 zbs1vWuoYhYG&|O??YEP;__khR)?pK7bbQjc%+a)DyZ!Z~@2;8}GUIpT3qVSi!cZ|@ zAgcvvYwH2DAHh>$?=bCnlvK~HlvS@a0kJuF{&f3Me;7O-(3_ukqS5#~jH^19Y*XcL z;HqsmY!7j6#POgW@w0nHK4YSk7M1NidRZ49d`ESv>cf(ovQkgMXBGjymm}t>&l-sR z<2%8A(KQn})`a1`o11?HhA-EU1`CKpdW>SVv6LW}cp=5aCOYi{+L5(7xbiRMxkxaO z5lkll0~rMY%#O~k=?1bXBA;pXzY*eZNjnLJMvr0uAEZx+68pT_w3{q?DXu{z!lqpR70mdTBRV~g3{VbmJ2gQ4!KFXD` zBCd_SHd!i81dV>4>vK~zYw9mVQPFG@@G+`s!_!_nKFHq z0B-5pY8)EmG1|-sU6gD=-|8}O~4e)6t0*Q;b5}R$C55m%KXz+`bjCi zJ&nS;6p5vvceV`yNts8w6!A>IcNJk4EfNv^ig34zxUYRa`GQwl`Ry<5TcD2-W(`$~ zjt-2i2=ig&#_yNK1QdJhY*u3SOE_NN(YI{kco+%Vc|SfaFqzx4OajP7{k2{I!9%S) z=RXcvR{+>rNefBv^hAFmXI9^#Tyk-rxz`Sl)Qwc=^-l>36uQUV9oA-$Ik4vw^x}9W zo2%vP3-1A{3Mg_Ij8`g;bdA}d!D7FAsXFWIzo?&3F$y3>xceMZR=5YGr|M!7en-|r zv$6CIeX}6vm;_r1IDf7$9(IRgIKHw+1#(-^@oo^gDwvjna>fr=QIP}Q95h!Q3_kpE zL;->U7_>h5`?N4vfJvWvdo=^X_drVwNCP)0$HfQvRB!~T26DJc`(odopBI>vg9W>9 zd4MS7#}O(ZhYtMb2L7MzKyzPOwa3g8rHk1k@5bBz^+Ad;O*|OCU6|qYs)an#lj#(D zXj$HP9+xza|0z7ry%}0L?X}kpwlDmxQ8yCWTYkhRkT&q2kad#K!D-!u!g(lx4gzW0 vT(`=vKSgs+7v#AAIsc#i`5)zD`snzY()_uFHt81V+de2QqZ_2_cccCbUVrAR literal 0 HcmV?d00001 diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/index.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/index.mdx new file mode 100644 index 000000000000000..d1ec10e77fa59f1 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/index.mdx @@ -0,0 +1,16 @@ +--- +title: Concepts +pcx_content_type: overview +sidebar: + order: 1 +--- + +Review the concepts behind Cloudflare's Email Security. + +## Objectives + +By the end of this module, you will be able to: + +* Explain how Cloudflare works. +* Describe what Email Security is. +* Understand how Cloudflare prevents email-based phishing attacks. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx new file mode 100644 index 000000000000000..2dfef77ba0644ef --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx @@ -0,0 +1,36 @@ +--- +title: How Cloudflare prevents email-based phishing attacks +pcx_content_type: overview +sidebar: + order: 4 +--- + +Email-based phishing attacks can be divided into two main categories: Those with and without a malicious URL or attachment. + +Email Security uses a variety of factors to determine whether a given email message, a web domain or URL, or specific network traffic is part of a phishing campaign (marked with a `Malicious` [disposition](/cloudflare-one/email-security/reference/dispositions-and-attributes/#dispositions)) or other common campaigns (for example, `Spam`). + +These small pattern assessments are dynamic in nature and — in many cases — no single one in and of itself will determine the final verdict. Instead, our automated systems use a combination of factors and non-factors to clearly distinguish between a valid phishing campaign and benign traffic. + +Emails without a Malicious URL or attachment typically fall into the Business Email Compromise (BEC) category. BEC is a type of social engineering attack. In a BEC attack, the attacker falsifies an email message to trick the victim into performing some action - most often transferring money to an account or location the attacker controls. + +To detect these low volume, malicious emails that do not contain malware, malicious links or email attachments, Cloudflare uses machine learning analysis, analyzing email threads, content, sentiment and context via message lexical analysis, subject analysis, word count assessment and sender analysis. Display names are also compared with known executive names for similarity using several matching modeling including the [Levenshtein Algorithm](https://en.wikipedia.org/wiki/Levenshtein_distance), and if matched, lagged when a sender is organization from an unknown domain. + +When malicious payloads or URLs are included or attached to an email, additional steps are taken to protect your users. For example: + +- **Attack type**: Malicious payload attached to the message. +- **Example**: Classic campaign technique which utilizes a variety of active attachment types (EXE, DOC, XLS, PPT, OLE, PDF, and more) as the malicious payload for ransomware attacks, Trojans, viruses, and malware. +- **Detections applied**: Machine learning (ML) models on binary bitmaps of the payload as well as higher-level attributes of the payload, with specific focus on signatureless detections for maximum coverage. Additionally, for relevant active payloads, the engine invokes a real-time sandbox to assess behavior and determine maliciousness. + +- **Attack type**: Encrypted malicious payload attached to the message, with password in message body as text. +- **Example**: Campaigns that induce the user to apply a password within the message body to the attachment. +- **Detections applied**: Real-time lexical parsing of message body for password extraction and ML models on binary bitmaps of the payload, signatureless detections for maximum coverage. + +- **Attack type**: Malicious URLs within message body. +- **Example**: Typical phish campaigns with a socially engineered call to action URL that will implant malware (for example, watering hole attacks, malvertising, or scripting attacks). +- **Detections applied**: Continuous web crawling, followed by real-time link crawling for a select group of suspicious urls, followed by machine learning applied to URL patterns in combination with other pattern rules and topic-based machine learning models for exhaustive coverage of link-based attacks. + +- **Attack type**: Malicious payload linked through a Malicious payload linked through a URL in a messageURL in a message. +- **Example**: Campaigns where the URL links through to a remote malicious attachment (for example, in a .doc or .pdf file). +- **Detections applied**: Remote document and/or attachment extraction followed by ML detection tree on the payload, instant crawl of links. + +Additional attack types and detections can be found [here](/cloudflare-one/email-security/reference/how-es-detects-phish/). \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/protect-from-phishing-attacks.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/protect-from-phishing-attacks.mdx new file mode 100644 index 000000000000000..4f7a175f50a4133 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/protect-from-phishing-attacks.mdx @@ -0,0 +1,10 @@ +--- +title: Protect your organization from phishing attacks +pcx_content_type: overview +sidebar: + order: 5 +--- + +In the early 2000s, Secure Email Gateways (SEGs) were introduced to deal with a growing need around the routing and filtering of email. While SEGs were successful at their mission for many years, their fundamental design has made it impossible for them to keep pace as phishing threats rapidly grow in scope and sophistication. Continuously updating manual rulesets and policies that were originally built for on-prem servers only inflates the amount of time and effort involved in maintaining a SEG. This has resulted in an increase in cost and complexity while still falling short of catching the most dangerous threats, such as business email compromise (BEC) attacks. +As organizations continue to adopt Microsoft 365 to enhance communication and collaboration for their hybrid workforce, it is crucial to take advantage of Microsoft's native security features while integrating complementary, machine learning-based solutions to automatically block and isolate the most dangerous threats. This strategy not only significantly reduces phishing risk, but also simplifies workflows, minimizing the time and effort needed for ongoing security management. +Analysts agree that consolidating capabilities to minimize overlapping functionality is helping organizations reduce cost and complexity. However, they also advise organization's to carefully assess native features to ensure they satisfy all use cases. As Microsoft continues to build out its essential email security features, the growing overlap with SEGs has given organizations an opportunity to streamline security operations by leveraging capabilities already included in their E3 or E5 license. This shift enables organizations to eliminate complex and costly SEG deployments, redirecting a fraction of that budget to integrate lightweight solutions that effectively address the most dangerous phishing threats. Cloudflare Email Security provides an integrated, low-touch solution that augments Microsoft 365 using machine learning threat analysis to automate the detection of BEC and multi-channel attacks. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-cloudflare.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-cloudflare.mdx new file mode 100644 index 000000000000000..47dc124925e08a0 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-cloudflare.mdx @@ -0,0 +1,10 @@ +--- +title: What is Cloudflare? +pcx_content_type: overview +sidebar: + order: 2 +--- + +import { Render } from "~/components" + + \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx new file mode 100644 index 000000000000000..85a7038fce24c47 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx @@ -0,0 +1,9 @@ +--- +title: What is a Email Security? +pcx_content_type: overview +sidebar: + order: 3 +--- + +Email security is the process of preventing [email-based](https://www.cloudflare.com/learning/email-security/what-is-email/) cyber attacks and unwanted communications. It spans protecting inboxes from takeover, protecting domains from spoofing, stopping phishing attacks, preventing fraud, blocking malware delivery, filtering spam, and using encryption to protect the contents of emails from unauthorized persons. +Security and privacy were not built into email when it was first invented, and despite email's importance as a communication method, these are still not built into email by default. As a result, email is a major attack vector for large and small organizations, and for individuals well. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx new file mode 100644 index 000000000000000..88a1f2120d8bf0e --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx @@ -0,0 +1,10 @@ +--- +title: What is a phishing attack? +pcx_content_type: overview +sidebar: + order: 2 +--- + +Email security is the process of preventing [email](https://www.cloudflare.com/learning/email-security/what-is-email/)-based cyber attacks and unwanted communications. It spans protecting inboxes from takeover, protecting domains from [spoofing](https://www.cloudflare.com/learning/ssl/what-is-domain-spoofing/), stopping [phishing attacks](https://www.cloudflare.com/learning/access-management/phishing-attack/), preventing fraud, blocking [malware](https://www.cloudflare.com/learning/ddos/glossary/malware/) delivery, filtering [spam](https://www.cloudflare.com/learning/email-security/how-to-stop-spam-emails/), and using [encryption](https://www.cloudflare.com/learning/ssl/what-is-encryption/) to protect the contents of emails from unauthorized persons.* + +Security and [privacy](https://www.cloudflare.com/learning/privacy/what-is-data-privacy/) were not built into email when it was first invented, and despite email's importance as a communication method, these are still not built into email by default. As a result, email is a major [attack vector](https://www.cloudflare.com/learning/security/glossary/attack-vector/) for large and small organizations, and for individuals well.* diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx new file mode 100644 index 000000000000000..6e1ad22c303521b --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx @@ -0,0 +1,17 @@ +--- +title: Create an Email Security account +pcx_content_type: overview +sidebar: + order: 3 +--- + +To create your Email Security account, you will need the alphanumeric string on the URL when logged in to the Cloudflare dashboard. + +If you do not have a Cloudflare account, you can create one for free, [here](https://dash.cloudflare.com/sign-up). + +From there, your account team will create an Email Security account for you. To establish your tenant, you will need the following information: + +- *Average Monthly Inbound Message Volume* +- *Number of Active Email Users* +- *Domain(s)* +- *Admin Email Address * \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/deployment-models.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/deployment-models.mdx new file mode 100644 index 000000000000000..7fa75418456ec51 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/deployment-models.mdx @@ -0,0 +1,11 @@ +--- +title: Deployment models +pcx_content_type: overview +sidebar: + order: 5 +--- + +While there are multiple deployment methods, the easiest way to get started with Email Security is via the API deployment method. + +When you choose the [API deployment](/cloudflare-one/email-security/setup/post-delivery-deployment/api/), Email Security can both scan and take actions on emails after they have reached a user's inbox. +With a [Journaling setup](/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/journaling-setup/office365-journaling/) alone without API integration, Email Security can only scan emails after it has reached a user's inbox. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx new file mode 100644 index 000000000000000..0a3b2af2985b4ca --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx @@ -0,0 +1,12 @@ +--- +title: Get started with Email Security +pcx_content_type: overview +sidebar: + order: 1 +--- + +In this learning path, you will learn how to protect your organization from phishing attacks with Email Security. +Your users will experience a reduction in spam and phishing emails and have simple ways to report any suspicious activity. +Administrators will be able to review detections and phishing trends that target their organization without having to tune Email Security. + +[Microsoft O365 API deployment diagram](/assets/images/email-security/deployment/api-setup/ms365-api-deployment.png) \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/initial-login.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/initial-login.mdx new file mode 100644 index 000000000000000..8561f09302d429c --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/initial-login.mdx @@ -0,0 +1,8 @@ +--- +title: Initial login +pcx_content_type: overview +sidebar: + order: 4 +--- + +{/* DOUBLE CHECK INFO ON LEARNING PATH DRAFT */} \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/prerequisites.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/prerequisites.mdx new file mode 100644 index 000000000000000..ea5b76ff764aa16 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/prerequisites.mdx @@ -0,0 +1,8 @@ +--- +title: Prerequisites +pcx_content_type: overview +sidebar: + order: 2 +--- + +To make the most of this learning path, make sure that you have access to Microsoft 365. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx new file mode 100644 index 000000000000000..d7a3bd63212a267 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx @@ -0,0 +1,16 @@ +--- +title: Recommended deployment models +pcx_content_type: overview +sidebar: + order: 6 +--- + +An API deployment model with Email Security has multiple benefits for Microsoft 365 Customers. + +The API deployment with Email Security offers: + +- Easy protection for complex email architectures, without requiring any change to mail flow operations. +- Agentless deployment for Microsoft O365. +- Office 365 directory integration to retrieve user and group information and prevent user impersonation. + +[Api and journaling deployment diagram](/assets/images/email-security/deployment/api-setup/api-and-journaling-deployment.png) diff --git a/src/content/learning-paths/secure-o365-email.json b/src/content/learning-paths/secure-o365-email.json new file mode 100644 index 000000000000000..77415dea474ef99 --- /dev/null +++ b/src/content/learning-paths/secure-o365-email.json @@ -0,0 +1,8 @@ +{ + "title": "Secure Your Microsoft 365 Email Environment with Email Security", + "path": "/learning-paths/secure-o365-email/", + "priority": 2, + "description": "Use Cloudflare's Email Security to protect your Microsoft 365 email inbox.", + "products": ["Email Security"], + "product_group": "Cloudflare One" +} From e0f373ca68e5530e176c983696eeeeb7874dd5d3 Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Thu, 14 Nov 2024 14:47:25 +0000 Subject: [PATCH 02/21] Update src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com> --- .../get-started/create-email-security-account.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx index 6e1ad22c303521b..5bd02132ce5e940 100644 --- a/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx @@ -7,7 +7,7 @@ sidebar: To create your Email Security account, you will need the alphanumeric string on the URL when logged in to the Cloudflare dashboard. -If you do not have a Cloudflare account, you can create one for free, [here](https://dash.cloudflare.com/sign-up). +If you do not have a Cloudflare account, you can create one for free by referring to the [Cloudflare sign-up page](https://dash.cloudflare.com/sign-up). From there, your account team will create an Email Security account for you. To establish your tenant, you will need the following information: From f7d4c12865356ba7e552250051dc897ea772d6b6 Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Thu, 14 Nov 2024 14:47:34 +0000 Subject: [PATCH 03/21] Update src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com> --- .../secure-o365-email/concepts/prevent-phishing-attack.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx index 2dfef77ba0644ef..6f99dc2902e1f19 100644 --- a/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx @@ -33,4 +33,4 @@ When malicious payloads or URLs are included or attached to an email, additional - **Example**: Campaigns where the URL links through to a remote malicious attachment (for example, in a .doc or .pdf file). - **Detections applied**: Remote document and/or attachment extraction followed by ML detection tree on the payload, instant crawl of links. -Additional attack types and detections can be found [here](/cloudflare-one/email-security/reference/how-es-detects-phish/). \ No newline at end of file +Additional attack types and detections can be found in the [Email Security Detection Methods](/cloudflare-one/email-security/reference/how-es-detects-phish/) documentation. \ No newline at end of file From 483ef171b830df353f8374df4b8e17125b39b6de Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Thu, 14 Nov 2024 14:47:55 +0000 Subject: [PATCH 04/21] Update src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com> From 74165da22400969c92f021b56cf8c18c8030d6c2 Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Thu, 14 Nov 2024 14:57:13 +0000 Subject: [PATCH 05/21] Adding LP to main directory --- .../implementation-guides/secure-o365-email.mdx | 7 +++++++ .../learning-paths/secure-o365-email/index.mdx | 15 +++++++++++++++ 2 files changed, 22 insertions(+) create mode 100644 src/content/docs/cloudflare-one/implementation-guides/secure-o365-email.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/index.mdx diff --git a/src/content/docs/cloudflare-one/implementation-guides/secure-o365-email.mdx b/src/content/docs/cloudflare-one/implementation-guides/secure-o365-email.mdx new file mode 100644 index 000000000000000..4dec0159066938d --- /dev/null +++ b/src/content/docs/cloudflare-one/implementation-guides/secure-o365-email.mdx @@ -0,0 +1,7 @@ +--- +pcx_content_type: navigation +title: Secure your Microsoft 365 email environment with Email Security +external_link: /learning-paths/secure-o365-email/ +sidebar: + order: 4 +--- \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/index.mdx b/src/content/docs/learning-paths/secure-o365-email/index.mdx new file mode 100644 index 000000000000000..5ea5b42c0a2b5f3 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/index.mdx @@ -0,0 +1,15 @@ +--- +title: Secure your Microsoft 365 email environment with Email Security +type: developers-site +new_learning_path: true +pcx_content_type: learning-path +head: + - tag: title + content: Secure your Microsoft 365 email environment with Email Security +description: Protect Microsoft 365 email from phishing attacks. + +--- + +import { LearningPath } from "~/components" + + From b7afd0f938efe3422ab92c96437f05281473b12e Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Fri, 15 Nov 2024 15:10:24 +0000 Subject: [PATCH 06/21] Fixing image issue + styling --- .../secure-o365-email/concepts/prevent-phishing-attack.mdx | 2 ++ .../secure-o365-email/concepts/what-is-email-security.mdx | 7 +++++-- .../get-started/create-email-security-account.mdx | 2 +- .../learning-paths/secure-o365-email/get-started/index.mdx | 2 +- .../get-started/recommended-deployment-model.mdx | 2 +- 5 files changed, 10 insertions(+), 5 deletions(-) diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx index 6f99dc2902e1f19..6df6950da8669ec 100644 --- a/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx @@ -15,6 +15,8 @@ Emails without a Malicious URL or attachment typically fall into the Business Em To detect these low volume, malicious emails that do not contain malware, malicious links or email attachments, Cloudflare uses machine learning analysis, analyzing email threads, content, sentiment and context via message lexical analysis, subject analysis, word count assessment and sender analysis. Display names are also compared with known executive names for similarity using several matching modeling including the [Levenshtein Algorithm](https://en.wikipedia.org/wiki/Levenshtein_distance), and if matched, lagged when a sender is organization from an unknown domain. +## Type of malicious attacks + When malicious payloads or URLs are included or attached to an email, additional steps are taken to protect your users. For example: - **Attack type**: Malicious payload attached to the message. diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx index 85a7038fce24c47..dd711745dcdfb3f 100644 --- a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx @@ -1,9 +1,12 @@ --- -title: What is a Email Security? +title: What is Email Security? pcx_content_type: overview sidebar: order: 3 --- -Email security is the process of preventing [email-based](https://www.cloudflare.com/learning/email-security/what-is-email/) cyber attacks and unwanted communications. It spans protecting inboxes from takeover, protecting domains from spoofing, stopping phishing attacks, preventing fraud, blocking malware delivery, filtering spam, and using encryption to protect the contents of emails from unauthorized persons. +Email security is the process of preventing [email-based](https://www.cloudflare.com/learning/email-security/what-is-email/) cyber attacks and unwanted communications. + +It spans protecting inboxes from takeover, protecting domains from spoofing, stopping phishing attacks, preventing fraud, blocking malware delivery, filtering spam, and using encryption to protect the contents of emails from unauthorized persons. + Security and privacy were not built into email when it was first invented, and despite email's importance as a communication method, these are still not built into email by default. As a result, email is a major attack vector for large and small organizations, and for individuals well. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx index 5bd02132ce5e940..30b19d89b539fb8 100644 --- a/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx @@ -14,4 +14,4 @@ From there, your account team will create an Email Security account for you. To - *Average Monthly Inbound Message Volume* - *Number of Active Email Users* - *Domain(s)* -- *Admin Email Address * \ No newline at end of file +- *Admin Email Address* \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx index 0a3b2af2985b4ca..591d1462d09b81d 100644 --- a/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx @@ -9,4 +9,4 @@ In this learning path, you will learn how to protect your organization from phis Your users will experience a reduction in spam and phishing emails and have simple ways to report any suspicious activity. Administrators will be able to review detections and phishing trends that target their organization without having to tune Email Security. -[Microsoft O365 API deployment diagram](/assets/images/email-security/deployment/api-setup/ms365-api-deployment.png) \ No newline at end of file +[Microsoft O365 API deployment diagram](~/assets/images/email-security/deployment/api-setup/ms365-api-deployment.png) \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx index d7a3bd63212a267..525febac9cc54f9 100644 --- a/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx @@ -13,4 +13,4 @@ The API deployment with Email Security offers: - Agentless deployment for Microsoft O365. - Office 365 directory integration to retrieve user and group information and prevent user impersonation. -[Api and journaling deployment diagram](/assets/images/email-security/deployment/api-setup/api-and-journaling-deployment.png) +[Api and journaling deployment diagram](~/assets/images/email-security/deployment/api-setup/api-and-journaling-deployment.png) From e5c957904c3d4c8f6e91246ca4872806c310b045 Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Fri, 15 Nov 2024 16:04:30 +0000 Subject: [PATCH 07/21] Adding module 3 --- .../api-and-journaling-deployment.png | Bin .../ms365-api-deployment.png | Bin .../active-directory-sync.mdx | 38 +++++++++++ .../create-allow-policies.mdx | 39 +++++++++++ .../impersonation-registry.mdx | 30 +++++++++ .../email-security-configuration/index.mdx | 8 +++ .../set-additional-detections.mdx | 61 ++++++++++++++++++ .../email-security-configuration/testing.mdx | 17 +++++ .../create-email-security-account.mdx | 8 +-- .../get-started/deployment-models.mdx | 1 + .../secure-o365-email/get-started/index.mdx | 2 +- .../get-started/prerequisites.mdx | 2 +- .../recommended-deployment-model.mdx | 2 +- 13 files changed, 201 insertions(+), 7 deletions(-) rename src/assets/images/{email-security/deployment/api-setup => learning-paths/secure-o365-email}/api-and-journaling-deployment.png (100%) rename src/assets/images/{email-security/deployment/api-setup => learning-paths/secure-o365-email}/ms365-api-deployment.png (100%) create mode 100644 src/content/docs/learning-paths/secure-o365-email/email-security-configuration/active-directory-sync.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/email-security-configuration/create-allow-policies.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/email-security-configuration/impersonation-registry.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/email-security-configuration/index.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/email-security-configuration/set-additional-detections.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/email-security-configuration/testing.mdx diff --git a/src/assets/images/email-security/deployment/api-setup/api-and-journaling-deployment.png b/src/assets/images/learning-paths/secure-o365-email/api-and-journaling-deployment.png similarity index 100% rename from src/assets/images/email-security/deployment/api-setup/api-and-journaling-deployment.png rename to src/assets/images/learning-paths/secure-o365-email/api-and-journaling-deployment.png diff --git a/src/assets/images/email-security/deployment/api-setup/ms365-api-deployment.png b/src/assets/images/learning-paths/secure-o365-email/ms365-api-deployment.png similarity index 100% rename from src/assets/images/email-security/deployment/api-setup/ms365-api-deployment.png rename to src/assets/images/learning-paths/secure-o365-email/ms365-api-deployment.png diff --git a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/active-directory-sync.mdx b/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/active-directory-sync.mdx new file mode 100644 index 000000000000000..b7140cae0d33e54 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/active-directory-sync.mdx @@ -0,0 +1,38 @@ +--- +title: Active directory sync +pcx_content_type: how-to +sidebar: + order: 2 +--- + +Directories are folders to store user data. Email Security allows you to manage directories from the Cloudflare dashboard. + +To manage a Microsoft directory: + +1. Log in to [Zero Trust ](https://one.dash.cloudflare.com/). +2. Select **Email security**. +3. Select **Directories**. +4. Under **Directory name**, select **MS directory**. +5. From here, you can manage **Groups** or **Users** directories. + +Email Security allows you to view and manage your groups directory and their [impersonation registry](https://developers.cloudflare.com/cloudflare-one/email-security/detection-settings/impersonation-registry/). +When a group is added to the registry, all members are registered by default. + +To manage your group directory, on the **MS directory** page, select **Groups**. + +To add a single group to the registry: + +1. Select the group name you want to add. +2. Select the three dots > **Add to registry**. + +To add multiple groups to the registry at once: + +1. Select the group names you want to add to the registry. +2. Select the **Action** dropdown list. +3. Select **Add to registry**. + +In addition, Email Security Allows you to: + +- [Remove groups from the registry](/cloudflare-one/email-security/directories/manage-ms-directories/manage-groups-directory/#remove-groups-from-registry) +- [Filter the impersonation registry](/cloudflare-one/email-security/directories/manage-ms-directories/manage-groups-directory/#filter-impersonation-registry) +- [Manage users in your directory](/cloudflare-one/email-security/directories/manage-ms-directories/manage-users-directory/) \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/create-allow-policies.mdx b/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/create-allow-policies.mdx new file mode 100644 index 000000000000000..750dc664742c9e7 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/create-allow-policies.mdx @@ -0,0 +1,39 @@ +--- +title: Create allow policies +pcx_content_type: how-to +sidebar: + order: 4 +--- + +Email Security allows you to configure allow policies. An allow policy exempts messages that match certain patterns from normal detection scanning. + +You can choose how Email Security will handle messages that match your criteria: + +- **Trusted Sender**: Messages will bypass all [detections](/cloudflare-one/email-security/reference/dispositions-and-attributes/) and link following by Email Security. Typically, it only applies to phishing simulations from vendors such as KnowBe4. +- **Exempt Recipient**: Will exempt messages from all Email Security [detections](/cloudflare-one/email-security/reference/dispositions-and-attributes/) intended for recipients matching this pattern (email address or regular expression only). Typically, this only applies to submission mailboxes for user reporting to security. +- **Acceptable Sender**: Will exempt messages from the `SPAM`, `SPOOF`, and `BULK` [dispositions](/cloudflare-one/email-security/reference/dispositions-and-attributes/) (but not `MALICIOUS` or `SUSPICIOUS`). Commonly used for external domains and sources that send mail on behalf of your organization, such as marketing emails or internal tools. + +## Configure allow policies + +To configure allow policies: + +1. Log in to [Zero Trust](https://one.dash.cloudflare.com/). +2. Select **Email Security**. +3. Select **Settings**, then go to **Detection settings** > **Allow policies**. +4. On the **Detection settings** page, select **Add a policy**. +5. On the **Add an allow policy** page, enter the policy information: + - **Input method**: Choose between **Manual input**, and **Uploading an allow policy**: + - **Manual input**: + - **Action**: Select one of the following to choose how Email Security will handle messages that match your criteria: + - **Trust sender**: Messages will bypass all detections and link following. + - **Exempt recipient**: Message to this recipient will bypass all detections. + - **Accept sender**: Messages from this sender will be exempted from Spam, Spoof, and Bulk dispositions. + - **Rule type**: Specify the scope of your policy. Choose one of the following: + - **Email addresses**: Must be a valid email. + - **IP addresses**: Can only be IPv4. IPv6 and CIDR are invalid entries. + - **Domains**: Must be a valid domain. + - **Regular expressions**: Must be valid Java expressions. Regular expressions are matched with fields related to the sender email address (envelope from, header from, reply-to), the originating IP address, and the server name for the email. + - **(Recommended) Sender verification**: This option enforces DMARC, SPF, or DKIM authentication. If you choose to enable this option, Email Security will only honor policies that pass authentication. + - **Notes**: Provide additional information about your allow policy. + - **Uploading an allow policy**: Upload a file no larger than 150 KB. The file can only contain `Pattern`, `Notes`, `Verify Email`, `Trusted Sender`, `Exempt Recipient` and `Acceptable Sender` fields. The first row must be a header row. +6. Select **Save**. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/impersonation-registry.mdx b/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/impersonation-registry.mdx new file mode 100644 index 000000000000000..fbf67ab79e14302 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/impersonation-registry.mdx @@ -0,0 +1,30 @@ +--- +title: Impersonation registry +pcx_content_type: how-to +sidebar: + order: 3 +--- + +Attackers often try to impersonate executives within an organization when sending malicious emails (with requests about banking information, trade secrets, and more), which is known as a Business Email Compromise (BEC) attack . + +This feature protects against these attacks by looking for spoofs of known key users in an organization . Information about key users you either synced with your directory or entered manually in the dashboard is used by Email Security to run enhanced scan techniques and find these spoofed emails. + +To add a user to the impersonation registry: + +1. Log in to [Zero Trust](https://one.dash.cloudflare.com/). +2. Select **Email Security**. +3. Select **Settings** > **Impersonation registry**. +4. Select **Add a user**. +5. Select **Input method**: Choose between **Manual input**, **Upload manual list**, and **Select from existing directories**: + - **Manual input**: Enter the following information: + - **User info**: enter a valid **Display name**. + - **User email**: Enter one of the following: + - **Email address**: Enter all known email addresses, separated by a comma. + - **Regular expressions**: Must be valid Java expressions. + - **Upload manual list**: You can upload a file no larger than 150 KB containing all variables of potential emails. The file must contain `Display_Name` and `Email`, and the first row must be the header row. + - **Select from existing directories**: + - **Select directory**: Select your directory. + - **Add users or groups**: Choose the users or groups you want to register. +6. Select **Save**. + +For more information on how to edit and remove users, refer to [Impersonation Registry](/cloudflare-one/email-security/detection-settings/impersonation-registry/#edit-users). \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/index.mdx b/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/index.mdx new file mode 100644 index 000000000000000..70f6400bac6c74b --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/index.mdx @@ -0,0 +1,8 @@ +--- +title: Initial Email Security Configuration +pcx_content_type: overview +sidebar: + order: 1 +--- + +With Email Security, there is limited manual configuration and tuning. The Active Directory sync, allow policies, and additional detections are important to consider when you set up the tool. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/set-additional-detections.mdx b/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/set-additional-detections.mdx new file mode 100644 index 000000000000000..2ce1f44c4a9f0e3 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/set-additional-detections.mdx @@ -0,0 +1,61 @@ +--- +title: Set additional detections +pcx_content_type: how-to +sidebar: + order: 5 +--- + +Email Security allows you to configure the following additional detections: + +- [Domain age](/cloudflare-one/email-security/detection-settings/additional-detections/#configure-domain-age) +- [Blank email detection](/cloudflare-one/email-security/detection-settings/additional-detections/#configure-blank-email-detection) +- [Automated Clearing House (ACH)](/cloudflare-one/email-security/detection-settings/additional-detections/#configure-ach-change-from-free-email-detection) change from free email detection. +- [HTML attachment email detection](/cloudflare-one/email-security/detection-settings/additional-detections/#configure-html-attachment-email-detection) + +To configure additional detections: + +1. Log in to [Zero Trust](https://one.dash.cloudflare.com/). +2. Select **Email Security**. +3. Select **Settings**. +4. On the Settings page, go to **Detection settings** > **Additional detections**, and select **Edit**. + +## Configure domain age + +The domain age is the time since the domain has been registered. + +To configure a domain age: + +1. On the **Edit additional detections** page: + - Select **Malicious domain age**: Controls the threshold for a malicious disposition. Maximum of 100 days. + - Select **Suspicious domain age**: Controls the threshold for a suspicious disposition. Maximum of 100 days. +2. Select **Save**. + +## Configure blank email detection + +Blank email detection detects emails with blank bodies and assigns a default disposition. You can choose between **Malicious** and **Suspicious** as dispositions. + +To enable blank email detection: + +1. On the **Edit additional detections** page, enable **Blank email detection**. +2. Choose between **Malicious** and **Suspicious**. +3. Select **Save**. + +## Configure ACH change from free email detection + +[Automated Clearing House (ACH)](https://en.wikipedia.org/wiki/Automated_clearing_house) is a banking term related to direct deposits. ACH change from free email detection detects payroll inquiries or change requests from free email domains and assigns a default disposition. You can choose between **Malicious** and **Suspicious** as dispositions. + +To enable ACH change from free email detection: + +1. On the **Edit additional detections** page, enable **ACH change from free email detection**. +2. Choose between **Malicious** and **Suspicious**. +3. Select **Save**. + +## Configure HTML Attachment Email Detection + +HTML attachment email detection detects HTM and HTML attachments in emails and assigns a default disposition. + +To enable HTML attachment email detection: + +1. On the **Edit additional detections** page, enable **HTML attachment email detection**. +2. Choose between **Malicious** and **Suspicious**. +3. Select **Save**. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/testing.mdx b/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/testing.mdx new file mode 100644 index 000000000000000..86cf561a5f51285 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/testing.mdx @@ -0,0 +1,17 @@ +--- +title: Testing before production deployment +pcx_content_type: how-to +sidebar: + order: 6 +--- + +Email Security can be deployed quickly. Setting up the Graph API only takes a few minutes. + +Email Security uses machine learning techniques to better understand your email environment. For this reason, there is a 5-7 day baseline period in which False Negative and False Positives are to be expected while the system learns what your normal mail patterns are. + +Moving from a cold start straight into production is not recommended. + +You can use the following testing methods which provide visibility during the baseline period without disruption to mail flow: + +- [Microsoft O365 Journaling Setup](/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/journaling-setup/office365-journaling/) +- [Microsoft O365 Graph API Setup](/cloudflare-one/email-security/setup/post-delivery-deployment/api/) \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx index 30b19d89b539fb8..d273e6180b01502 100644 --- a/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx @@ -11,7 +11,7 @@ If you do not have a Cloudflare account, you can create one for free by referrin From there, your account team will create an Email Security account for you. To establish your tenant, you will need the following information: -- *Average Monthly Inbound Message Volume* -- *Number of Active Email Users* -- *Domain(s)* -- *Admin Email Address* \ No newline at end of file +- Average monthly inbound message volume +- Number of active email users +- At least one domain +- Admin email address \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/deployment-models.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/deployment-models.mdx index 7fa75418456ec51..0e8ad9c87904f27 100644 --- a/src/content/docs/learning-paths/secure-o365-email/get-started/deployment-models.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/deployment-models.mdx @@ -8,4 +8,5 @@ sidebar: While there are multiple deployment methods, the easiest way to get started with Email Security is via the API deployment method. When you choose the [API deployment](/cloudflare-one/email-security/setup/post-delivery-deployment/api/), Email Security can both scan and take actions on emails after they have reached a user's inbox. + With a [Journaling setup](/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/journaling-setup/office365-journaling/) alone without API integration, Email Security can only scan emails after it has reached a user's inbox. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx index 591d1462d09b81d..fdededaaa6e038e 100644 --- a/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx @@ -9,4 +9,4 @@ In this learning path, you will learn how to protect your organization from phis Your users will experience a reduction in spam and phishing emails and have simple ways to report any suspicious activity. Administrators will be able to review detections and phishing trends that target their organization without having to tune Email Security. -[Microsoft O365 API deployment diagram](~/assets/images/email-security/deployment/api-setup/ms365-api-deployment.png) \ No newline at end of file +![Microsoft O365 API deployment diagram](~/assets/images/learning-paths/secure-o365-email/ms365-api-deployment.png) \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/prerequisites.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/prerequisites.mdx index ea5b76ff764aa16..66f515a72ffd3db 100644 --- a/src/content/docs/learning-paths/secure-o365-email/get-started/prerequisites.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/prerequisites.mdx @@ -5,4 +5,4 @@ sidebar: order: 2 --- -To make the most of this learning path, make sure that you have access to Microsoft 365. \ No newline at end of file +To make the most of this learning path, make sure you have access to Microsoft 365. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx index 525febac9cc54f9..8656a9e8482daf3 100644 --- a/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx @@ -13,4 +13,4 @@ The API deployment with Email Security offers: - Agentless deployment for Microsoft O365. - Office 365 directory integration to retrieve user and group information and prevent user impersonation. -[Api and journaling deployment diagram](~/assets/images/email-security/deployment/api-setup/api-and-journaling-deployment.png) +![Api and journaling deployment diagram](~/assets/images/learning-paths/secure-o365-email/api-and-journaling-deployment.png) \ No newline at end of file From 5fa12f494847277c69fab642c761e7e4e4ae7899 Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Fri, 15 Nov 2024 16:10:48 +0000 Subject: [PATCH 08/21] Fix link --- .../email-security-configuration/active-directory-sync.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/active-directory-sync.mdx b/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/active-directory-sync.mdx index b7140cae0d33e54..b4671927534334e 100644 --- a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/active-directory-sync.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/active-directory-sync.mdx @@ -15,7 +15,7 @@ To manage a Microsoft directory: 4. Under **Directory name**, select **MS directory**. 5. From here, you can manage **Groups** or **Users** directories. -Email Security allows you to view and manage your groups directory and their [impersonation registry](https://developers.cloudflare.com/cloudflare-one/email-security/detection-settings/impersonation-registry/). +Email Security allows you to view and manage your groups directory and their [impersonation registry](/cloudflare-one/email-security/detection-settings/impersonation-registry/). When a group is added to the registry, all members are registered by default. To manage your group directory, on the **MS directory** page, select **Groups**. From cd4c00165f496471f20c32f6b50d262b59a8072f Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Mon, 18 Nov 2024 18:53:25 +0000 Subject: [PATCH 09/21] Adding some bits of module 4 --- .../pre-production-deployment/audit-logs.mdx | 6 ++++++ .../email-dispositions.mdx | 8 ++++++++ .../enable-auto-move.mdx | 10 ++++++++++ .../pre-production-deployment/index.mdx | 8 ++++++++ .../phish-report.mdx | 15 ++++++++++++++ .../search-inbox.mdx | 14 +++++++++++++ .../submit-a-phish.mdx | 20 +++++++++++++++++++ .../access-application/best-practices.mdx | 2 +- 8 files changed, 82 insertions(+), 1 deletion(-) create mode 100644 src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/audit-logs.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/email-dispositions.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/enable-auto-move.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/index.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/phish-report.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/search-inbox.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/submit-a-phish.mdx diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/audit-logs.mdx b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/audit-logs.mdx new file mode 100644 index 000000000000000..3b00a71f5be7008 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/audit-logs.mdx @@ -0,0 +1,6 @@ +--- +title: Audit logs +pcx_content_type: how-to +sidebar: + order: 4 +--- diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/email-dispositions.mdx b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/email-dispositions.mdx new file mode 100644 index 000000000000000..860b45b2322af73 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/email-dispositions.mdx @@ -0,0 +1,8 @@ +--- +title: Email dispositions +pcx_content_type: how-to +sidebar: + order: 2 +--- + +{/* CREATE PARTIAL */} \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/enable-auto-move.mdx b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/enable-auto-move.mdx new file mode 100644 index 000000000000000..c2ee8218cf1ed10 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/enable-auto-move.mdx @@ -0,0 +1,10 @@ +--- +title: Enable auto-move options +pcx_content_type: how-to +sidebar: + order: 2 +--- + +When you set up auto-moves in Section 5, you can move messages manually or set up automatic moves to send messages matching certain dispositions to specific folders within a user’s mailbox. You can also enable Post Delivery Response and Phish Submission Response to re-evaluate messages previously delivered against new information gathered by Email Security. Scanned emails that were previously delivered and now match this new phishing information will be moved. + +Refer to the Office 365 guide in section 5 for detailed information. diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/index.mdx b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/index.mdx new file mode 100644 index 000000000000000..533121f5e4fdfe7 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/index.mdx @@ -0,0 +1,8 @@ +--- +title: What to consider prior to production deployment +pcx_content_type: overview +sidebar: + order: 1 +--- + +Before deploying Email Security to production, you will have to consider reporting any phishing attacks, evaluating which disposition to assign a specific message, and using different screen criteria to search through your inbox. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/phish-report.mdx b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/phish-report.mdx new file mode 100644 index 000000000000000..fb8352aa9824499 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/phish-report.mdx @@ -0,0 +1,15 @@ +--- +title: Phish reports +pcx_content_type: how-to +sidebar: + order: 4 +--- + +Email Security automatically generates a Phishing Risk Assessment Report (PRA) to provide an overview of your email traffic. The report only includes malicious emails. Spam and bulk emails are not included. + +To generate a phishing risk assessment report: + +1. Log in to [Zero Trust](https://one.dash.cloudflare.com/). +2. Select **Monitoring**. +3. Select **Generate summary report**. +4. Select **Generate and download**. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/search-inbox.mdx b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/search-inbox.mdx new file mode 100644 index 000000000000000..36d02385034cfbf --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/search-inbox.mdx @@ -0,0 +1,14 @@ +--- +title: Search through your inbox +pcx_content_type: how-to +sidebar: + order: 3 +--- + +With Email Security, you can use different screen criteria to search through your email inbox.There are three to scan through your email inbox: + +- **Popular screen**: Allows you to view messages based on common pre-defined criteria. +- **Regular screen**: Allows you to investigate your inbox by inserting a term to screen across all criteria. +- **Advanced screen**: Allows you to narrow message results based on specific criteria. + +Refer to [Search email](https://developers.cloudflare.com/cloudflare-one/insights/email-monitoring/search-email/) for advanced documentation. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/submit-a-phish.mdx b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/submit-a-phish.mdx new file mode 100644 index 000000000000000..5724368953f19a6 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/submit-a-phish.mdx @@ -0,0 +1,20 @@ +--- +title: Submit a phish +pcx_content_type: how-to +sidebar: + order: 2 +--- + +PhishNet is an add-in button that helps users to submit directly to Email Security phish samples missed by Email Security detection. + +PhishNet is an add-in button that helps users to submit directly to Email Security phish samples missed by Email Security's detection. + +To set up PhishNet O365: + +1. Log in to the Microsoft admin panel. Go to **Microsoft 365 admin center** > **Settings** > **Integrated Apps**. +2. Select **Upload custom apps**. +3. Choose **Provide link to manifest file** and paste the the following URL: + ```txt + https://phishnet-o365.area1cloudflare-webapps.workers.dev?clientId=ODcxNDA0MjMyNDM3NTA4NjQwNDk1Mzc3MDIxNzE0OTcxNTg0Njk5NDEyOTE2NDU5ODQyNjU5NzYzNjYyNDQ3NjEwMzIxODEyMDk1NQ + ``` +4. Verify and complete the wizard. \ No newline at end of file diff --git a/src/content/docs/learning-paths/zero-trust-web-access/access-application/best-practices.mdx b/src/content/docs/learning-paths/zero-trust-web-access/access-application/best-practices.mdx index 88e47ccf4ca2342..822ed84e9dd94d2 100644 --- a/src/content/docs/learning-paths/zero-trust-web-access/access-application/best-practices.mdx +++ b/src/content/docs/learning-paths/zero-trust-web-access/access-application/best-practices.mdx @@ -24,4 +24,4 @@ Access applications have an inherently flexible and powerful domain structure ca Many customers who have workflows designed around internal web applications, especially those that were built internally, often see challenges related to interdependencies on multiple internal services. Separately, there can be challenges related to SPAs (Single-Page Applications) that make onboarding to a Zero Trust Web Access service difficult. For example, an application may have iFrames or other embedded systems that rely on different internal and/or external addresses. -If your internal service operates in this way, we recommend specifying multiple top-level domains in a single Access application. Otherwise, if the goal of using multiple domains is to streamline or simplify policy creation, we recommend making one primary domain per application, and automating the rest of your deployment [using Terraform](/learning-paths/zero-trust-web-access/terraform/) or another Infrastructure as Code (IaC) service. +If your internal service operates in this way, we recommend specifying multiple top-level domains in a single Access application. Otherwise, if the goal of using multiple domains is to streamline or simplify policy creation, we recommend making one primary domain per application, and automating the rest of your deployment [using Terraform](/learning-paths/zero-trust-web-access/terraform/) or another Infrastructure as Code (IaC) service. \ No newline at end of file From 4c2a1fb0e94a3fa38cffc5462c5c30267fb5f767 Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Mon, 18 Nov 2024 18:54:15 +0000 Subject: [PATCH 10/21] Fixing link --- .../secure-o365-email/pre-production-deployment/audit-logs.mdx | 2 ++ .../pre-production-deployment/enable-auto-move.mdx | 2 +- .../pre-production-deployment/search-inbox.mdx | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/audit-logs.mdx b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/audit-logs.mdx index 3b00a71f5be7008..67eb3055c3ae46d 100644 --- a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/audit-logs.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/audit-logs.mdx @@ -4,3 +4,5 @@ pcx_content_type: how-to sidebar: order: 4 --- + +{/* CIRCLE BACK ON THIS SECTION */} \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/enable-auto-move.mdx b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/enable-auto-move.mdx index c2ee8218cf1ed10..af095c1c4ddd984 100644 --- a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/enable-auto-move.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/enable-auto-move.mdx @@ -7,4 +7,4 @@ sidebar: When you set up auto-moves in Section 5, you can move messages manually or set up automatic moves to send messages matching certain dispositions to specific folders within a user’s mailbox. You can also enable Post Delivery Response and Phish Submission Response to re-evaluate messages previously delivered against new information gathered by Email Security. Scanned emails that were previously delivered and now match this new phishing information will be moved. -Refer to the Office 365 guide in section 5 for detailed information. +Refer to the Office 365 guide in section 5 for detailed information. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/search-inbox.mdx b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/search-inbox.mdx index 36d02385034cfbf..6826b950bcc3bfe 100644 --- a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/search-inbox.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/search-inbox.mdx @@ -11,4 +11,4 @@ With Email Security, you can use different screen criteria to search through you - **Regular screen**: Allows you to investigate your inbox by inserting a term to screen across all criteria. - **Advanced screen**: Allows you to narrow message results based on specific criteria. -Refer to [Search email](https://developers.cloudflare.com/cloudflare-one/insights/email-monitoring/search-email/) for advanced documentation. \ No newline at end of file +Refer to [Search email](/cloudflare-one/insights/email-monitoring/search-email/) for advanced documentation. \ No newline at end of file From ae1416b53a58d76daa11847ead0190fb812918eb Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Tue, 19 Nov 2024 12:07:54 +0000 Subject: [PATCH 11/21] Adding modules 5 and 6 --- .../email-security-configuration/index.mdx | 2 +- .../enable-auto-moves/index.mdx | 8 ++++++++ .../monitor-your-inbox/index.mdx | 10 ++++++++++ .../monitor-your-inbox/monitor-detections.mdx | 17 ++++++++++++++++ .../monitor-your-inbox/phish-submissions.mdx | 17 ++++++++++++++++ .../monitor-your-inbox/phishguard.mdx | 20 +++++++++++++++++++ .../monitor-your-inbox/report-phish.mdx | 10 ++++++++++ .../enable-auto-move.mdx | 4 +++- .../submit-a-phish.mdx | 2 ++ 9 files changed, 88 insertions(+), 2 deletions(-) create mode 100644 src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/index.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phish-submissions.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phishguard.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/report-phish.mdx diff --git a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/index.mdx b/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/index.mdx index 70f6400bac6c74b..41288481b136459 100644 --- a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/index.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/index.mdx @@ -1,5 +1,5 @@ --- -title: Initial Email Security Configuration +title: Initial Email Security configuration pcx_content_type: overview sidebar: order: 1 diff --git a/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx b/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx new file mode 100644 index 000000000000000..82d7efb088b510f --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx @@ -0,0 +1,8 @@ +--- +title: Enable auto-moves +pcx_content_type: overview +sidebar: + order: 4 +--- + +Now that you have configured Email Security, you can start taking action by enabling auto-moves to protect your users from spam and phishing attacks. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/index.mdx b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/index.mdx new file mode 100644 index 000000000000000..98a89cad240cb0e --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/index.mdx @@ -0,0 +1,10 @@ +--- +title: Monitor your inbox +pcx_content_type: overview +sidebar: + order: 6 +--- + +Once you have fully deployed Email Security, there is limited tuning and configuration work. + +Monitor detections, submit any potential misses and leverage PhishGuard to ensure a seamless experience. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx new file mode 100644 index 000000000000000..86cb75d5a09556e --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx @@ -0,0 +1,17 @@ +--- +title: Monitor detections +pcx_content_type: how-to +sidebar: + order: 2 +--- + +Spam and Malicious emails are blocked outright by Email Security, but suspicious and spoof dispositions should be monitored. Suspicious messages should be investigated by a security analyst to determine the legitimacy of the message. + +[PhishGuard](/cloudflare-one/email-security/phish-guard/), Cloudflare's managed email security service can review these messages for you and move them from the end user inbox if they are deemed malicious. + +Messages that receive a Spoof disposition should be investigated as well because it signals that the traffic is either non-compliant with your email authentication process [SPF](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-spf-record/), [DKIM](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dkim-record/), [DMARC](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dmarc-record/), or has a mismatching Envelope From and Header From value. + +In most cases, this disposition is triggered by a legitimate third-party mail service. If you determine that the Spoofed email is a legitimate business use case, you can either: + +- Update your email authentication records. +- Add an acceptable sender [allow policy](/cloudflare-one/email-security/detection-settings/allow-policies/) to exempt messages from the Spam, Spoof or Bulk disposition, but not Malicious or Suspicious, so the content of the message can still be monitored. diff --git a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phish-submissions.mdx b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phish-submissions.mdx new file mode 100644 index 000000000000000..399512180427287 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phish-submissions.mdx @@ -0,0 +1,17 @@ +--- +title: Phish submissions +pcx_content_type: how-to +sidebar: + order: 3 +--- + +While Email Security offers industry leading detection efficacy due to Cloudflare's Threat Intelligence, Preemptive Threat Hunting (actor and campaign infrastructure hunting with 8B, plus campaign threat signals assessed every day) and ML-Based Detection Models (Trust Graphs Computer Vision, Sentiment/Thread/ Structural Analysis, Industry/Natural Language Understanding Modeling) false negatives and false positive can occur. + +There are two different ways to [submit a phish](/cloudflare-one/insights/email-monitoring/phish-submissions/) sample: + +- User submission: + - Submitted directly by the end user, and used with phish submission buttons. To learn more about user-submitted phish, refer to [PhishNet for Microsoft O365](/cloudflare-one/insights/email-monitoring/phish-submissions/#phishnet-o365). + - User submissions can create another challenge for your organization. While it is important for end users to be vigilant and report what they believe may be a phishing email, they are often wrong. About 90% of the time, when an end user reports a missed phishing email, they are mistaken. This puts an extra burden on busy security teams as they sift through end user reports. The PhishGuard team at Cloudflare can solve this problem for your organization by reviewing end user submissions for you. +- Admin submission: + - To be used when IT administrators or security teams submit to Email Security. Submit original phish samples as an attachment in EML format to the appropriate team submission address. + - Within the Email Security dashboard, Phish submissions will allow you to have a full understanding of what reclassification has been made and what the outcomes of those submissions are. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phishguard.mdx b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phishguard.mdx new file mode 100644 index 000000000000000..591a56946ad06db --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phishguard.mdx @@ -0,0 +1,20 @@ +--- +title: PhishGuard +pcx_content_type: how-to +sidebar: + order: 5 +--- + +[PhishGuard](/cloudflare-one/email-security/phish-guard/) serves as an extension of your Security Operations team with dedicated Email Security technical resources providing real-time monitoring of your email environment. The Active Defense Service provides: + +- Customized notification and responses for fraud and insider threats. +- Reclassification of messages if the disposition is incorrect. +- PhishGuard monitors and reviews Suspicious email traffic. +- Quarantine and auto-move of identified threats. +- Tailored threat hunting for your email environment. +- Custom detections. + +As a PhishGuard customer, the following service offerings should be enabled: + +- Escalation contacts must be configured in the Email Security dashboard: This allows for email reports to be delivered regarding high risk items identified and responded to by the team. +- Auto-moves should be enabled and configured for quarantine of identified items: `MALICIOUS` should be prioritized, but configuring Spam for a move to junk/trash or even soft delete may also be highly useful to the client. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/report-phish.mdx b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/report-phish.mdx new file mode 100644 index 000000000000000..cab239ecebd5269 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/report-phish.mdx @@ -0,0 +1,10 @@ +--- +title: Report phish +pcx_content_type: how-to +sidebar: + order: 4 +--- + +Email Security gives you multiple ways to keep tabs on the systems to better understand phishing trends, how your organization is being targeted, who your top targets are and more. + +Refer to the reporting section in Module 4 for additional details. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/enable-auto-move.mdx b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/enable-auto-move.mdx index af095c1c4ddd984..a0ecedc2037d1de 100644 --- a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/enable-auto-move.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/enable-auto-move.mdx @@ -5,6 +5,8 @@ sidebar: order: 2 --- -When you set up auto-moves in Section 5, you can move messages manually or set up automatic moves to send messages matching certain dispositions to specific folders within a user’s mailbox. You can also enable Post Delivery Response and Phish Submission Response to re-evaluate messages previously delivered against new information gathered by Email Security. Scanned emails that were previously delivered and now match this new phishing information will be moved. +When you set up auto-moves in Section 5, you can move messages manually or set up automatic moves to send messages matching certain dispositions to specific folders within a user’s mailbox. + +You can also enable Post Delivery Response and Phish Submission Response to re-evaluate messages previously delivered against new information gathered by Email Security. Scanned emails that were previously delivered and now match this new phishing information will be moved. Refer to the Office 365 guide in section 5 for detailed information. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/submit-a-phish.mdx b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/submit-a-phish.mdx index 5724368953f19a6..9584145ce54df27 100644 --- a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/submit-a-phish.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/submit-a-phish.mdx @@ -5,6 +5,8 @@ sidebar: order: 2 --- +import { GlossaryTooltip} from "~/components" + PhishNet is an add-in button that helps users to submit directly to Email Security phish samples missed by Email Security detection. PhishNet is an add-in button that helps users to submit directly to Email Security phish samples missed by Email Security's detection. From bf12bcecc0fa36cb8000cefdc5a466055a5f13b7 Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Tue, 19 Nov 2024 12:58:42 +0000 Subject: [PATCH 12/21] Shortening learning path title --- src/content/docs/learning-paths/secure-o365-email/index.mdx | 6 +++--- src/content/learning-paths/secure-o365-email.json | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/content/docs/learning-paths/secure-o365-email/index.mdx b/src/content/docs/learning-paths/secure-o365-email/index.mdx index 5ea5b42c0a2b5f3..d3cc76ba0e3f731 100644 --- a/src/content/docs/learning-paths/secure-o365-email/index.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/index.mdx @@ -1,12 +1,12 @@ --- -title: Secure your Microsoft 365 email environment with Email Security +title: Secure Microsoft 365 email with Email Security type: developers-site new_learning_path: true pcx_content_type: learning-path head: - tag: title - content: Secure your Microsoft 365 email environment with Email Security -description: Protect Microsoft 365 email from phishing attacks. + content: Secure Microsoft 365 email with Email Security +description: Protect Microsoft 365 email from phishing and malware attacks. --- diff --git a/src/content/learning-paths/secure-o365-email.json b/src/content/learning-paths/secure-o365-email.json index 77415dea474ef99..8116b354ab58e3a 100644 --- a/src/content/learning-paths/secure-o365-email.json +++ b/src/content/learning-paths/secure-o365-email.json @@ -1,8 +1,8 @@ { - "title": "Secure Your Microsoft 365 Email Environment with Email Security", + "title": "Secure Microsoft 365 email with Email Security", "path": "/learning-paths/secure-o365-email/", "priority": 2, - "description": "Use Cloudflare's Email Security to protect your Microsoft 365 email inbox.", + "description": "Use Cloudflare's Email Security to protect your Microsoft 365 email inbox from phishing and malware attacks.", "products": ["Email Security"], "product_group": "Cloudflare One" } From 92110c6d37b6e68aa1d5dbe9646c3ac740088aee Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Tue, 19 Nov 2024 14:48:19 +0000 Subject: [PATCH 13/21] Improve formatting --- .vscode/settings.json | 3 ++- .../implementation-guides/secure-o365-email.mdx | 2 +- .../concepts/prevent-phishing-attack.mdx | 12 ++++++++---- .../concepts/protect-from-phishing-attacks.mdx | 10 ++++++++-- .../concepts/what-is-email-security.mdx | 6 ++++-- .../concepts/what-is-phishing-attack.mdx | 8 ++++++-- .../docs/learning-paths/secure-o365-email/index.mdx | 4 ++-- src/content/learning-paths/secure-o365-email.json | 2 +- 8 files changed, 32 insertions(+), 15 deletions(-) diff --git a/.vscode/settings.json b/.vscode/settings.json index 2f50be09c286fba..3db80df4eb78452 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -3,5 +3,6 @@ "editor.formatOnSave": true, "editor.defaultFormatter": "esbenp.prettier-vscode", "typescript.tsdk": "node_modules/typescript/lib", - "cSpell.enableFiletypes": ["mdx"] + "cSpell.enableFiletypes": ["mdx"], + "editor.wordWrap": "on" } diff --git a/src/content/docs/cloudflare-one/implementation-guides/secure-o365-email.mdx b/src/content/docs/cloudflare-one/implementation-guides/secure-o365-email.mdx index 4dec0159066938d..a134ff3972ccce6 100644 --- a/src/content/docs/cloudflare-one/implementation-guides/secure-o365-email.mdx +++ b/src/content/docs/cloudflare-one/implementation-guides/secure-o365-email.mdx @@ -1,6 +1,6 @@ --- pcx_content_type: navigation -title: Secure your Microsoft 365 email environment with Email Security +title: Secure Microsoft 365 email with Email Security external_link: /learning-paths/secure-o365-email/ sidebar: order: 4 diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx index 6df6950da8669ec..eba9e0215ca2d8a 100644 --- a/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx @@ -19,19 +19,23 @@ To detect these low volume, malicious emails that do not contain malware, malici When malicious payloads or URLs are included or attached to an email, additional steps are taken to protect your users. For example: -- **Attack type**: Malicious payload attached to the message. +### Malicious payload attached to the message + - **Example**: Classic campaign technique which utilizes a variety of active attachment types (EXE, DOC, XLS, PPT, OLE, PDF, and more) as the malicious payload for ransomware attacks, Trojans, viruses, and malware. - **Detections applied**: Machine learning (ML) models on binary bitmaps of the payload as well as higher-level attributes of the payload, with specific focus on signatureless detections for maximum coverage. Additionally, for relevant active payloads, the engine invokes a real-time sandbox to assess behavior and determine maliciousness. -- **Attack type**: Encrypted malicious payload attached to the message, with password in message body as text. +### Encrypted malicious payload attached to the message, with password in message body as text + - **Example**: Campaigns that induce the user to apply a password within the message body to the attachment. - **Detections applied**: Real-time lexical parsing of message body for password extraction and ML models on binary bitmaps of the payload, signatureless detections for maximum coverage. -- **Attack type**: Malicious URLs within message body. +### Malicious URLs within message body + - **Example**: Typical phish campaigns with a socially engineered call to action URL that will implant malware (for example, watering hole attacks, malvertising, or scripting attacks). - **Detections applied**: Continuous web crawling, followed by real-time link crawling for a select group of suspicious urls, followed by machine learning applied to URL patterns in combination with other pattern rules and topic-based machine learning models for exhaustive coverage of link-based attacks. -- **Attack type**: Malicious payload linked through a Malicious payload linked through a URL in a messageURL in a message. +### Malicious payload linked through a malicious payload linked through a URL + - **Example**: Campaigns where the URL links through to a remote malicious attachment (for example, in a .doc or .pdf file). - **Detections applied**: Remote document and/or attachment extraction followed by ML detection tree on the payload, instant crawl of links. diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/protect-from-phishing-attacks.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/protect-from-phishing-attacks.mdx index 4f7a175f50a4133..889b9c12ebb188b 100644 --- a/src/content/docs/learning-paths/secure-o365-email/concepts/protect-from-phishing-attacks.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/protect-from-phishing-attacks.mdx @@ -5,6 +5,12 @@ sidebar: order: 5 --- -In the early 2000s, Secure Email Gateways (SEGs) were introduced to deal with a growing need around the routing and filtering of email. While SEGs were successful at their mission for many years, their fundamental design has made it impossible for them to keep pace as phishing threats rapidly grow in scope and sophistication. Continuously updating manual rulesets and policies that were originally built for on-prem servers only inflates the amount of time and effort involved in maintaining a SEG. This has resulted in an increase in cost and complexity while still falling short of catching the most dangerous threats, such as business email compromise (BEC) attacks. +In the early 2000s, Secure Email Gateways (SEGs) were introduced to deal with a growing need around the routing and filtering of email. While SEGs were successful at their mission for many years, their fundamental design has made it impossible for them to keep pace as phishing threats rapidly grow in scope and sophistication. + +Continuously updating manual rulesets and policies that were originally built for on-prem servers only inflates the amount of time and effort involved in maintaining a SEG. This has resulted in an increase in cost and complexity while still falling short of catching the most dangerous threats, such as business email compromise (BEC) attacks. + As organizations continue to adopt Microsoft 365 to enhance communication and collaboration for their hybrid workforce, it is crucial to take advantage of Microsoft's native security features while integrating complementary, machine learning-based solutions to automatically block and isolate the most dangerous threats. This strategy not only significantly reduces phishing risk, but also simplifies workflows, minimizing the time and effort needed for ongoing security management. -Analysts agree that consolidating capabilities to minimize overlapping functionality is helping organizations reduce cost and complexity. However, they also advise organization's to carefully assess native features to ensure they satisfy all use cases. As Microsoft continues to build out its essential email security features, the growing overlap with SEGs has given organizations an opportunity to streamline security operations by leveraging capabilities already included in their E3 or E5 license. This shift enables organizations to eliminate complex and costly SEG deployments, redirecting a fraction of that budget to integrate lightweight solutions that effectively address the most dangerous phishing threats. Cloudflare Email Security provides an integrated, low-touch solution that augments Microsoft 365 using machine learning threat analysis to automate the detection of BEC and multi-channel attacks. \ No newline at end of file + +Analysts agree that consolidating capabilities to minimize overlapping functionality is helping organizations reduce cost and complexity. However, they also advise organization's to carefully assess native features to ensure they satisfy all use cases. As Microsoft continues to build out its essential email security features, the growing overlap with SEGs has given organizations an opportunity to streamline security operations by leveraging capabilities already included in their E3 or E5 license. + +This shift enables organizations to eliminate complex and costly SEG deployments, redirecting a fraction of that budget to integrate lightweight solutions that effectively address the most dangerous phishing threats. Cloudflare Email Security provides an integrated, low-touch solution that augments Microsoft 365 using machine learning threat analysis to automate the detection of BEC and multi-channel attacks. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx index dd711745dcdfb3f..09030698b103d9f 100644 --- a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx @@ -5,8 +5,10 @@ sidebar: order: 3 --- -Email security is the process of preventing [email-based](https://www.cloudflare.com/learning/email-security/what-is-email/) cyber attacks and unwanted communications. +Email security is the process of preventing email-based cyber attacks and unwanted communications. It spans protecting inboxes from takeover, protecting domains from spoofing, stopping phishing attacks, preventing fraud, blocking malware delivery, filtering spam, and using encryption to protect the contents of emails from unauthorized persons. -Security and privacy were not built into email when it was first invented, and despite email's importance as a communication method, these are still not built into email by default. As a result, email is a major attack vector for large and small organizations, and for individuals well. \ No newline at end of file +Security and privacy were not built into email when it was first invented, and despite email's importance as a communication method, these are still not built into email by default. As a result, email is a major attack vector for large and small organizations, and for individuals well. + +For more information on email security, refer to the [Learning Center](https://www.cloudflare.com/learning/email-security/what-is-email/). \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx index 88a1f2120d8bf0e..0066c55c8f3e2df 100644 --- a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx @@ -5,6 +5,10 @@ sidebar: order: 2 --- -Email security is the process of preventing [email](https://www.cloudflare.com/learning/email-security/what-is-email/)-based cyber attacks and unwanted communications. It spans protecting inboxes from takeover, protecting domains from [spoofing](https://www.cloudflare.com/learning/ssl/what-is-domain-spoofing/), stopping [phishing attacks](https://www.cloudflare.com/learning/access-management/phishing-attack/), preventing fraud, blocking [malware](https://www.cloudflare.com/learning/ddos/glossary/malware/) delivery, filtering [spam](https://www.cloudflare.com/learning/email-security/how-to-stop-spam-emails/), and using [encryption](https://www.cloudflare.com/learning/ssl/what-is-encryption/) to protect the contents of emails from unauthorized persons.* +Email security is the process of preventing email-based cyber attacks and unwanted communications. -Security and [privacy](https://www.cloudflare.com/learning/privacy/what-is-data-privacy/) were not built into email when it was first invented, and despite email's importance as a communication method, these are still not built into email by default. As a result, email is a major [attack vector](https://www.cloudflare.com/learning/security/glossary/attack-vector/) for large and small organizations, and for individuals well.* +It spans protecting inboxes from takeover, protecting domains from spoofing, stopping phishing attacks, preventing fraud, blocking malware delivery, filtering spam, and using encryption to protect the contents of emails from unauthorized persons. + +Security and privacy were not built into email when it was first invented. Despite email's importance as a communication method, security and privacy are still not built into email by default. As a result, email is a major attack vector for large and small organizations, and for individuals well. + +For more information on what a phishing attack is, refer to the [Learning Center](https://www.cloudflare.com/en-gb/learning/access-management/phishing-attack/). \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/index.mdx b/src/content/docs/learning-paths/secure-o365-email/index.mdx index d3cc76ba0e3f731..a12f0213928aefc 100644 --- a/src/content/docs/learning-paths/secure-o365-email/index.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/index.mdx @@ -5,11 +5,11 @@ new_learning_path: true pcx_content_type: learning-path head: - tag: title - content: Secure Microsoft 365 email with Email Security + content: Secure Microsoft 365 email with Email Security. description: Protect Microsoft 365 email from phishing and malware attacks. --- import { LearningPath } from "~/components" - + \ No newline at end of file diff --git a/src/content/learning-paths/secure-o365-email.json b/src/content/learning-paths/secure-o365-email.json index 8116b354ab58e3a..9cffc5564cb7b6c 100644 --- a/src/content/learning-paths/secure-o365-email.json +++ b/src/content/learning-paths/secure-o365-email.json @@ -5,4 +5,4 @@ "description": "Use Cloudflare's Email Security to protect your Microsoft 365 email inbox from phishing and malware attacks.", "products": ["Email Security"], "product_group": "Cloudflare One" -} +} \ No newline at end of file From 8d1ad3439fd5b334c81778f99c26882a9d7939a3 Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Wed, 4 Dec 2024 15:53:55 +0000 Subject: [PATCH 14/21] Reorganize, adding table --- .../concepts/prevent-phishing-attack.mdx | 38 ++++--------------- .../protect-from-phishing-attacks.mdx | 2 +- .../concepts/what-is-email-security.mdx | 10 ++--- .../concepts/what-is-phishing-attack.mdx | 10 ++--- .../active-directory-sync.mdx | 4 +- .../configure-email-security/audit-logs.mdx | 21 ++++++++++ .../create-allow-policies.mdx | 0 .../impersonation-registry.mdx | 2 +- .../index.mdx | 6 +-- .../report-phish.mdx} | 15 ++++---- .../set-additional-detections.mdx | 0 .../email-security-configuration/testing.mdx | 17 --------- .../configure-auto-moves.mdx | 24 ++++++++++++ .../enable-auto-moves/email-dispositions.mdx | 12 ++++++ .../enable-auto-moves/index.mdx | 2 +- .../get-started/deployment-models.mdx | 2 +- .../secure-o365-email/get-started/index.mdx | 4 +- .../get-started/initial-login.mdx | 6 ++- .../recommended-deployment-model.mdx | 6 +-- .../monitor-your-inbox/index.mdx | 25 ++++++++++-- .../monitor-your-inbox/monitor-detections.mdx | 16 ++++++++ .../monitor-your-inbox/phish-submissions.mdx | 6 ++- .../monitor-your-inbox/report-phish.mdx | 10 ----- .../pre-production-deployment/audit-logs.mdx | 8 ---- .../email-dispositions.mdx | 8 ---- .../enable-auto-move.mdx | 12 ------ .../pre-production-deployment/index.mdx | 8 ---- .../phish-report.mdx | 15 -------- .../search-inbox.mdx | 14 ------- .../zero-trust/email-dispositions.mdx | 12 ++++++ 30 files changed, 152 insertions(+), 163 deletions(-) rename src/content/docs/learning-paths/secure-o365-email/{email-security-configuration => configure-email-security}/active-directory-sync.mdx (95%) create mode 100644 src/content/docs/learning-paths/secure-o365-email/configure-email-security/audit-logs.mdx rename src/content/docs/learning-paths/secure-o365-email/{email-security-configuration => configure-email-security}/create-allow-policies.mdx (100%) rename src/content/docs/learning-paths/secure-o365-email/{email-security-configuration => configure-email-security}/impersonation-registry.mdx (97%) rename src/content/docs/learning-paths/secure-o365-email/{email-security-configuration => configure-email-security}/index.mdx (59%) rename src/content/docs/learning-paths/secure-o365-email/{pre-production-deployment/submit-a-phish.mdx => configure-email-security/report-phish.mdx} (50%) rename src/content/docs/learning-paths/secure-o365-email/{email-security-configuration => configure-email-security}/set-additional-detections.mdx (100%) delete mode 100644 src/content/docs/learning-paths/secure-o365-email/email-security-configuration/testing.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/configure-auto-moves.mdx create mode 100644 src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/email-dispositions.mdx delete mode 100644 src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/report-phish.mdx delete mode 100644 src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/audit-logs.mdx delete mode 100644 src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/email-dispositions.mdx delete mode 100644 src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/enable-auto-move.mdx delete mode 100644 src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/index.mdx delete mode 100644 src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/phish-report.mdx delete mode 100644 src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/search-inbox.mdx create mode 100644 src/content/partials/learning-paths/zero-trust/email-dispositions.mdx diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx index eba9e0215ca2d8a..48eb96a90ad080a 100644 --- a/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/prevent-phishing-attack.mdx @@ -2,41 +2,19 @@ title: How Cloudflare prevents email-based phishing attacks pcx_content_type: overview sidebar: - order: 4 + order: 5 --- -Email-based phishing attacks can be divided into two main categories: Those with and without a malicious URL or attachment. +Cloudflare Email Security uses a variety of factors to determine whether a given email message attachment, URL, or specific network traffic is part of a phishing campaign. -Email Security uses a variety of factors to determine whether a given email message, a web domain or URL, or specific network traffic is part of a phishing campaign (marked with a `Malicious` [disposition](/cloudflare-one/email-security/reference/dispositions-and-attributes/#dispositions)) or other common campaigns (for example, `Spam`). +These small pattern assessments are dynamic in nature. Cloudflare's automated systems use a combination of factors to clearly distinguish between a valid phishing campaign and benign traffic. -These small pattern assessments are dynamic in nature and — in many cases — no single one in and of itself will determine the final verdict. Instead, our automated systems use a combination of factors and non-factors to clearly distinguish between a valid phishing campaign and benign traffic. +Cloudflare's vast global network detects emergent campaign infrastructure and aggregates data for Cloudflare's proprietary analytics engine SPARSE. -Emails without a Malicious URL or attachment typically fall into the Business Email Compromise (BEC) category. BEC is a type of social engineering attack. In a BEC attack, the attacker falsifies an email message to trick the victim into performing some action - most often transferring money to an account or location the attacker controls. +SPARSE uses AI and ML models to make effective detections for all types of malicious emails, including Business Email Compromise (BEC). -To detect these low volume, malicious emails that do not contain malware, malicious links or email attachments, Cloudflare uses machine learning analysis, analyzing email threads, content, sentiment and context via message lexical analysis, subject analysis, word count assessment and sender analysis. Display names are also compared with known executive names for similarity using several matching modeling including the [Levenshtein Algorithm](https://en.wikipedia.org/wiki/Levenshtein_distance), and if matched, lagged when a sender is organization from an unknown domain. +In a BEC attack, the attacker falsifies an email message to trick the victim into performing some action - most often transferring money to an account or location the attacker controls. -## Type of malicious attacks +To detect these low volume, malicious emails that do not contain malware, malicious links or email attachments, Cloudflare analyzes the email thread, content, sentiment and context via message lexical analysis, subject analysis and sender analysis. Display names are also compared with known executive names for similarity using several matching models. -When malicious payloads or URLs are included or attached to an email, additional steps are taken to protect your users. For example: - -### Malicious payload attached to the message - -- **Example**: Classic campaign technique which utilizes a variety of active attachment types (EXE, DOC, XLS, PPT, OLE, PDF, and more) as the malicious payload for ransomware attacks, Trojans, viruses, and malware. -- **Detections applied**: Machine learning (ML) models on binary bitmaps of the payload as well as higher-level attributes of the payload, with specific focus on signatureless detections for maximum coverage. Additionally, for relevant active payloads, the engine invokes a real-time sandbox to assess behavior and determine maliciousness. - -### Encrypted malicious payload attached to the message, with password in message body as text - -- **Example**: Campaigns that induce the user to apply a password within the message body to the attachment. -- **Detections applied**: Real-time lexical parsing of message body for password extraction and ML models on binary bitmaps of the payload, signatureless detections for maximum coverage. - -### Malicious URLs within message body - -- **Example**: Typical phish campaigns with a socially engineered call to action URL that will implant malware (for example, watering hole attacks, malvertising, or scripting attacks). -- **Detections applied**: Continuous web crawling, followed by real-time link crawling for a select group of suspicious urls, followed by machine learning applied to URL patterns in combination with other pattern rules and topic-based machine learning models for exhaustive coverage of link-based attacks. - -### Malicious payload linked through a malicious payload linked through a URL - -- **Example**: Campaigns where the URL links through to a remote malicious attachment (for example, in a .doc or .pdf file). -- **Detections applied**: Remote document and/or attachment extraction followed by ML detection tree on the payload, instant crawl of links. - -Additional attack types and detections can be found in the [Email Security Detection Methods](/cloudflare-one/email-security/reference/how-es-detects-phish/) documentation. \ No newline at end of file +Refer to [How we detect phish](/email-security/reference/how-we-detect-phish/#sample-attack-types-and-detections) to learn more about additional attack types and detections. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/protect-from-phishing-attacks.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/protect-from-phishing-attacks.mdx index 889b9c12ebb188b..bb2f22ebeed1a6e 100644 --- a/src/content/docs/learning-paths/secure-o365-email/concepts/protect-from-phishing-attacks.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/protect-from-phishing-attacks.mdx @@ -2,7 +2,7 @@ title: Protect your organization from phishing attacks pcx_content_type: overview sidebar: - order: 5 + order: 6 --- In the early 2000s, Secure Email Gateways (SEGs) were introduced to deal with a growing need around the routing and filtering of email. While SEGs were successful at their mission for many years, their fundamental design has made it impossible for them to keep pace as phishing threats rapidly grow in scope and sophistication. diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx index 09030698b103d9f..62ca3484ecd762b 100644 --- a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx @@ -2,13 +2,9 @@ title: What is Email Security? pcx_content_type: overview sidebar: - order: 3 + order: 4 --- -Email security is the process of preventing email-based cyber attacks and unwanted communications. +Despite email's importance as a communication method, security and privacy were not built into the [The Simple Mail Transfer Protocol (SMTP) protocol](https://www.cloudflare.com/learning/email-security/what-is-smtp/) As a result, email is a major attack vector. -It spans protecting inboxes from takeover, protecting domains from spoofing, stopping phishing attacks, preventing fraud, blocking malware delivery, filtering spam, and using encryption to protect the contents of emails from unauthorized persons. - -Security and privacy were not built into email when it was first invented, and despite email's importance as a communication method, these are still not built into email by default. As a result, email is a major attack vector for large and small organizations, and for individuals well. - -For more information on email security, refer to the [Learning Center](https://www.cloudflare.com/learning/email-security/what-is-email/). \ No newline at end of file +Email security is the process of preventing [email-based](https://www.cloudflare.com/learning/email-security/what-is-email/) cyber attacks and unwanted communications. It spans protecting inboxes from takeover, protecting domains from [spoofing](https://www.cloudflare.com/learning/ssl/what-is-domain-spoofing/), stopping [phishing attacks](https://www.cloudflare.com/learning/access-management/phishing-attack/), preventing fraud, blocking [malware](https://www.cloudflare.com/learning/ddos/glossary/malware/) delivery and filtering [spam](https://www.cloudflare.com/learning/email-security/how-to-stop-spam-emails/). \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx index 0066c55c8f3e2df..2880fe280e122a4 100644 --- a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx @@ -2,13 +2,11 @@ title: What is a phishing attack? pcx_content_type: overview sidebar: - order: 2 + order: 3 --- -Email security is the process of preventing email-based cyber attacks and unwanted communications. +[Phishing](https://www.cloudflare.com/en-gb/learning/access-management/phishing-attack/) is an attempt to steal sensitive data, typically in the form of usernames, passwords, or other important account information. The phisher either uses the stolen information themselves, for instance to take over the user's accounts with their password, or sells the stolen information. -It spans protecting inboxes from takeover, protecting domains from spoofing, stopping phishing attacks, preventing fraud, blocking malware delivery, filtering spam, and using encryption to protect the contents of emails from unauthorized persons. +Phishing attackers disguise themselves as a reputable source. With an enticing or seemingly urgent request, an attacker lures the victim into providing information, just as a person uses bait while fishing. -Security and privacy were not built into email when it was first invented. Despite email's importance as a communication method, security and privacy are still not built into email by default. As a result, email is a major attack vector for large and small organizations, and for individuals well. - -For more information on what a phishing attack is, refer to the [Learning Center](https://www.cloudflare.com/en-gb/learning/access-management/phishing-attack/). \ No newline at end of file +Phishing often takes place over email. Phishers either try to trick people into emailing information directly, or link to a webpage they control that is designed to look legitimate (for instance, a fake login page where the user enters their password). \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/active-directory-sync.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/active-directory-sync.mdx similarity index 95% rename from src/content/docs/learning-paths/secure-o365-email/email-security-configuration/active-directory-sync.mdx rename to src/content/docs/learning-paths/secure-o365-email/configure-email-security/active-directory-sync.mdx index b4671927534334e..d62fcfcfad3bd85 100644 --- a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/active-directory-sync.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/active-directory-sync.mdx @@ -1,5 +1,5 @@ --- -title: Active directory sync +title: Manage your active directory pcx_content_type: how-to sidebar: order: 2 @@ -31,7 +31,7 @@ To add multiple groups to the registry at once: 2. Select the **Action** dropdown list. 3. Select **Add to registry**. -In addition, Email Security Allows you to: +In addition, Email Security allows you to: - [Remove groups from the registry](/cloudflare-one/email-security/directories/manage-ms-directories/manage-groups-directory/#remove-groups-from-registry) - [Filter the impersonation registry](/cloudflare-one/email-security/directories/manage-ms-directories/manage-groups-directory/#filter-impersonation-registry) diff --git a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/audit-logs.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/audit-logs.mdx new file mode 100644 index 000000000000000..6e996cae4476813 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/audit-logs.mdx @@ -0,0 +1,21 @@ +--- +title: Enable audit logs +pcx_content_type: how-to +sidebar: + order: 4 +--- + +With Email Security, you can enable logs to review actions performed on your account. + +To enable audit logs: + +1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/). +2. Select **Analytics & Logs** > Logpush. +3. Select **Audit logs**. +4. **Under Configure logpush job**: + - **Job name**: Enter the job name. + - **If logs match**: Select Filtered logs: + - **Field**: Choose `ResourceType`. + - **Operator**: Choose `starts with`. + - **Value**: Enter `email_security`. +5. Select **Submit**. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/create-allow-policies.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx similarity index 100% rename from src/content/docs/learning-paths/secure-o365-email/email-security-configuration/create-allow-policies.mdx rename to src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx diff --git a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/impersonation-registry.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/impersonation-registry.mdx similarity index 97% rename from src/content/docs/learning-paths/secure-o365-email/email-security-configuration/impersonation-registry.mdx rename to src/content/docs/learning-paths/secure-o365-email/configure-email-security/impersonation-registry.mdx index fbf67ab79e14302..5e3e7fbfcf60799 100644 --- a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/impersonation-registry.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/impersonation-registry.mdx @@ -1,5 +1,5 @@ --- -title: Impersonation registry +title: Add user to the impersonation registry pcx_content_type: how-to sidebar: order: 3 diff --git a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/index.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/index.mdx similarity index 59% rename from src/content/docs/learning-paths/secure-o365-email/email-security-configuration/index.mdx rename to src/content/docs/learning-paths/secure-o365-email/configure-email-security/index.mdx index 41288481b136459..dc919b3c41763ea 100644 --- a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/index.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/index.mdx @@ -1,8 +1,8 @@ --- -title: Initial Email Security configuration +title: Configure Email Security pcx_content_type: overview sidebar: - order: 1 + order: 3 --- -With Email Security, there is limited manual configuration and tuning. The Active Directory sync, allow policies, and additional detections are important to consider when you set up the tool. \ No newline at end of file +With Email Security, there is limited manual configuration and tuning. The Active Directory sync, allow policies, and additional detections are important to consider when you set up Email Security. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/submit-a-phish.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/report-phish.mdx similarity index 50% rename from src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/submit-a-phish.mdx rename to src/content/docs/learning-paths/secure-o365-email/configure-email-security/report-phish.mdx index 9584145ce54df27..7018dbb598b0529 100644 --- a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/submit-a-phish.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/report-phish.mdx @@ -1,22 +1,21 @@ --- -title: Submit a phish +title: Report phish pcx_content_type: how-to sidebar: - order: 2 + order: 4 --- -import { GlossaryTooltip} from "~/components" +Before deploying Email Security to production, you will have to consider reporting any phishing attacks, evaluating which disposition to assign a specific message, and using different screen criteria to search through your inbox. PhishNet is an add-in button that helps users to submit directly to Email Security phish samples missed by Email Security detection. -PhishNet is an add-in button that helps users to submit directly to Email Security phish samples missed by Email Security's detection. - To set up PhishNet O365: 1. Log in to the Microsoft admin panel. Go to **Microsoft 365 admin center** > **Settings** > **Integrated Apps**. 2. Select **Upload custom apps**. 3. Choose **Provide link to manifest file** and paste the the following URL: - ```txt - https://phishnet-o365.area1cloudflare-webapps.workers.dev?clientId=ODcxNDA0MjMyNDM3NTA4NjQwNDk1Mzc3MDIxNzE0OTcxNTg0Njk5NDEyOTE2NDU5ODQyNjU5NzYzNjYyNDQ3NjEwMzIxODEyMDk1NQ - ``` + +```txt +https://phishnet-o365.area1cloudflare-webapps.workers.dev?clientId=ODcxNDA0MjMyNDM3NTA4NjQwNDk1Mzc3MDIxNzE0OTcxNTg0Njk5NDEyOTE2NDU5ODQyNjU5NzYzNjYyNDQ3NjEwMzIxODEyMDk1NQ +``` 4. Verify and complete the wizard. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/set-additional-detections.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/set-additional-detections.mdx similarity index 100% rename from src/content/docs/learning-paths/secure-o365-email/email-security-configuration/set-additional-detections.mdx rename to src/content/docs/learning-paths/secure-o365-email/configure-email-security/set-additional-detections.mdx diff --git a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/testing.mdx b/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/testing.mdx deleted file mode 100644 index 86cf561a5f51285..000000000000000 --- a/src/content/docs/learning-paths/secure-o365-email/email-security-configuration/testing.mdx +++ /dev/null @@ -1,17 +0,0 @@ ---- -title: Testing before production deployment -pcx_content_type: how-to -sidebar: - order: 6 ---- - -Email Security can be deployed quickly. Setting up the Graph API only takes a few minutes. - -Email Security uses machine learning techniques to better understand your email environment. For this reason, there is a 5-7 day baseline period in which False Negative and False Positives are to be expected while the system learns what your normal mail patterns are. - -Moving from a cold start straight into production is not recommended. - -You can use the following testing methods which provide visibility during the baseline period without disruption to mail flow: - -- [Microsoft O365 Journaling Setup](/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/journaling-setup/office365-journaling/) -- [Microsoft O365 Graph API Setup](/cloudflare-one/email-security/setup/post-delivery-deployment/api/) \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/configure-auto-moves.mdx b/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/configure-auto-moves.mdx new file mode 100644 index 000000000000000..f490911955b3c23 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/configure-auto-moves.mdx @@ -0,0 +1,24 @@ +--- +title: Configure auto-moves +pcx_content_type: overview +sidebar: + order: 3 +--- + +To configure auto-move events: + +1. Log in to [Zero Trust](https://one.dash.cloudflare.com/). +2. Select **Email security**. +3. Select **Settings**. +4. Select **Moves**. +5. Under **Auto-moves**, select **Configure**. +6. Assign actions based on malicious, spoof, suspicious, spam, and bulk dispositions. Select among: + - **Soft delete - user recoverable**: Moves the message to the user's **Recoverable Items - Deleted** folder. Messages can be recovered by the user. + - **Hard delete - admin recoverable**: Completely deletes messages from a user's inbox. + - **Move to trash**: Moves messages to the trash or deleted items email folder. + - **Move to junk**: Moves the message to the junk or spam folder. + - **No action**: Messages stay in the origin folder. +7. Select **Post-delivery** moves: + - **(Recommended) Post-delivery response**: Enabling this option allows Email Security to rescan delivered emails at multiple time intervals for previously unknown phishing sites or campaigns. + - **(Recommended) Phish submission response**: Enabling this option allows Email Security to move emails that your users reported as phishing and Email Security determined to be malicious. +8. Select **Save**. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/email-dispositions.mdx b/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/email-dispositions.mdx new file mode 100644 index 000000000000000..dfbf32cd9022d30 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/email-dispositions.mdx @@ -0,0 +1,12 @@ +--- +title: Email dispositions +pcx_content_type: overview +sidebar: + order: 2 +--- + +import { Render } from "~/components" + +Email Security returns five potential verdicts for every email it scans. Review detections and consider how you would treat them once an auto-move is enabled. Below is an overview of the disposition and recommendation actions by Cloudflare: + + \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx b/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx index 82d7efb088b510f..d26c9b4244c0873 100644 --- a/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx @@ -5,4 +5,4 @@ sidebar: order: 4 --- -Now that you have configured Email Security, you can start taking action by enabling auto-moves to protect your users from spam and phishing attacks. \ No newline at end of file +When you set up auto-moves, you can move messages manually or set up automatic moves to send messages matching certain [dispositions](/learning-paths/secure-o365-email/enable-auto-moves/email-dispositions/) to specific folders within a user's mailbox. You can also enable Post Delivery Response and Phish Submission Response to re-evaluate messages previously delivered against new information gathered by Email Security. Scanned emails that were previously delivered and now match this new phishing information will be moved. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/deployment-models.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/deployment-models.mdx index 0e8ad9c87904f27..b45cea2d378922c 100644 --- a/src/content/docs/learning-paths/secure-o365-email/get-started/deployment-models.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/deployment-models.mdx @@ -2,7 +2,7 @@ title: Deployment models pcx_content_type: overview sidebar: - order: 5 + order: 4 --- While there are multiple deployment methods, the easiest way to get started with Email Security is via the API deployment method. diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx index fdededaaa6e038e..f6f82fcaa1c8c6f 100644 --- a/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx @@ -6,7 +6,9 @@ sidebar: --- In this learning path, you will learn how to protect your organization from phishing attacks with Email Security. + Your users will experience a reduction in spam and phishing emails and have simple ways to report any suspicious activity. + Administrators will be able to review detections and phishing trends that target their organization without having to tune Email Security. -![Microsoft O365 API deployment diagram](~/assets/images/learning-paths/secure-o365-email/ms365-api-deployment.png) \ No newline at end of file +This module will kickstart your email flow. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/initial-login.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/initial-login.mdx index 8561f09302d429c..1b9224d53a72956 100644 --- a/src/content/docs/learning-paths/secure-o365-email/get-started/initial-login.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/initial-login.mdx @@ -2,7 +2,9 @@ title: Initial login pcx_content_type: overview sidebar: - order: 4 + order: 3 --- -{/* DOUBLE CHECK INFO ON LEARNING PATH DRAFT */} \ No newline at end of file +Once your tenant is created by your account team, you will receive an email that grants you access to the Email Security platform. + +Multi-factor authentication is required, so you will need an authenticator tool to set up your second factor prior to gaining access. Scan the QR code, set up your second factor, create a new password and enter the Email Security portal. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx index 8656a9e8482daf3..252c3a9b1c96dab 100644 --- a/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx @@ -1,8 +1,8 @@ --- -title: Recommended deployment models +title: Recommended deployment model pcx_content_type: overview sidebar: - order: 6 + order: 5 --- An API deployment model with Email Security has multiple benefits for Microsoft 365 Customers. @@ -13,4 +13,4 @@ The API deployment with Email Security offers: - Agentless deployment for Microsoft O365. - Office 365 directory integration to retrieve user and group information and prevent user impersonation. -![Api and journaling deployment diagram](~/assets/images/learning-paths/secure-o365-email/api-and-journaling-deployment.png) \ No newline at end of file +![Microsoft 365 API deployment diagram](~/assets/images/learning-paths/secure-o365-email/ms365-api-deployment.png) \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/index.mdx b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/index.mdx index 98a89cad240cb0e..682cf5b2c38ed92 100644 --- a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/index.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/index.mdx @@ -1,10 +1,27 @@ --- -title: Monitor your inbox +title: Monitor your email activity pcx_content_type: overview sidebar: - order: 6 + order: 5 --- -Once you have fully deployed Email Security, there is limited tuning and configuration work. +To access an overview of your account, total number of emails processed, a breakdown of types of threads detected, among other types of information: -Monitor detections, submit any potential misses and leverage PhishGuard to ensure a seamless experience. \ No newline at end of file +1. Log in to [Zero Trust.](https://one.dash.cloudflare.com/) +2. Select **Email Security**. + +Under **Email Security**, select **Monitoring**. + +The dashboard will display the following metrics: + +- Email activity +- [Disposition evaluation](/cloudflare-one/email-security/reference/dispositions-and-attributes/) +- Detection details +- [Impersonations](/cloudflare-one/email-security/detection-settings/impersonation-registry/) +- [Phish submissions](/cloudflare-one/insights/email-monitoring/phish-submissions/) +- [Auto-move events](/cloudflare-one/email-security/auto-moves/) +- [Detection settings metrics](/cloudflare-one/email-security/detection-settings/) + +Email activity aggregates statistics about emails scanned and dispositions assigned (the number of email flagged due to a detection) within a given timeframe. + +To view the live number of email scanned and dispositions scanned, enable **Live mode**. diff --git a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx index 86cb75d5a09556e..a3b0965398252e1 100644 --- a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx @@ -15,3 +15,19 @@ In most cases, this disposition is triggered by a legitimate third-party mail se - Update your email authentication records. - Add an acceptable sender [allow policy](/cloudflare-one/email-security/detection-settings/allow-policies/) to exempt messages from the Spam, Spoof or Bulk disposition, but not Malicious or Suspicious, so the content of the message can still be monitored. + +## Search email messages + +Email Security offers a variety of ways for you to better examine and understand your message traffic: + +You can search for emails that have been processed by Email Security, whether they are marked with a[ detection disposition](/email-security/reference/dispositions-and-attributes/) or not. + +There are three ways for searching emails: + +- Popular screen: A popular screen allows you to view messages based on common pre-defined criteria. +- Regular screen: A regular screen allows you to investigate your inbox by inserting a term to screen across all criteria. +- Advanced screen: The advanced screen criteria gives you the option to narrow message results based on specific criteria. The advanced screen has several options (such as keywords, subject keywords, sender domain, and more) to scan your inbox. + +Additional information on search can be found on the [Screen criteria](/email-security/reporting/search/) documentation. + +With Email Security, you can export messages to a CSV file. Via the dashboard, you can export up to 1,000 rows. If you want to export all messages, you can use the [API](https://developers.cloudflare.com/api/operations/email_security_get_message). \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phish-submissions.mdx b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phish-submissions.mdx index 399512180427287..326719ff1d4e85b 100644 --- a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phish-submissions.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phish-submissions.mdx @@ -14,4 +14,8 @@ There are two different ways to [submit a phish](/cloudflare-one/insights/email- - User submissions can create another challenge for your organization. While it is important for end users to be vigilant and report what they believe may be a phishing email, they are often wrong. About 90% of the time, when an end user reports a missed phishing email, they are mistaken. This puts an extra burden on busy security teams as they sift through end user reports. The PhishGuard team at Cloudflare can solve this problem for your organization by reviewing end user submissions for you. - Admin submission: - To be used when IT administrators or security teams submit to Email Security. Submit original phish samples as an attachment in EML format to the appropriate team submission address. - - Within the Email Security dashboard, Phish submissions will allow you to have a full understanding of what reclassification has been made and what the outcomes of those submissions are. \ No newline at end of file + - Within the Email Security dashboard, Phish submissions will allow you to have a full understanding of what reclassification has been made and what the outcomes of those submissions are. + +## Importance of submissions for Machine Learning Models + +## Sanitation of EML submission \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/report-phish.mdx b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/report-phish.mdx deleted file mode 100644 index cab239ecebd5269..000000000000000 --- a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/report-phish.mdx +++ /dev/null @@ -1,10 +0,0 @@ ---- -title: Report phish -pcx_content_type: how-to -sidebar: - order: 4 ---- - -Email Security gives you multiple ways to keep tabs on the systems to better understand phishing trends, how your organization is being targeted, who your top targets are and more. - -Refer to the reporting section in Module 4 for additional details. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/audit-logs.mdx b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/audit-logs.mdx deleted file mode 100644 index 67eb3055c3ae46d..000000000000000 --- a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/audit-logs.mdx +++ /dev/null @@ -1,8 +0,0 @@ ---- -title: Audit logs -pcx_content_type: how-to -sidebar: - order: 4 ---- - -{/* CIRCLE BACK ON THIS SECTION */} \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/email-dispositions.mdx b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/email-dispositions.mdx deleted file mode 100644 index 860b45b2322af73..000000000000000 --- a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/email-dispositions.mdx +++ /dev/null @@ -1,8 +0,0 @@ ---- -title: Email dispositions -pcx_content_type: how-to -sidebar: - order: 2 ---- - -{/* CREATE PARTIAL */} \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/enable-auto-move.mdx b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/enable-auto-move.mdx deleted file mode 100644 index a0ecedc2037d1de..000000000000000 --- a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/enable-auto-move.mdx +++ /dev/null @@ -1,12 +0,0 @@ ---- -title: Enable auto-move options -pcx_content_type: how-to -sidebar: - order: 2 ---- - -When you set up auto-moves in Section 5, you can move messages manually or set up automatic moves to send messages matching certain dispositions to specific folders within a user’s mailbox. - -You can also enable Post Delivery Response and Phish Submission Response to re-evaluate messages previously delivered against new information gathered by Email Security. Scanned emails that were previously delivered and now match this new phishing information will be moved. - -Refer to the Office 365 guide in section 5 for detailed information. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/index.mdx b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/index.mdx deleted file mode 100644 index 533121f5e4fdfe7..000000000000000 --- a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/index.mdx +++ /dev/null @@ -1,8 +0,0 @@ ---- -title: What to consider prior to production deployment -pcx_content_type: overview -sidebar: - order: 1 ---- - -Before deploying Email Security to production, you will have to consider reporting any phishing attacks, evaluating which disposition to assign a specific message, and using different screen criteria to search through your inbox. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/phish-report.mdx b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/phish-report.mdx deleted file mode 100644 index fb8352aa9824499..000000000000000 --- a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/phish-report.mdx +++ /dev/null @@ -1,15 +0,0 @@ ---- -title: Phish reports -pcx_content_type: how-to -sidebar: - order: 4 ---- - -Email Security automatically generates a Phishing Risk Assessment Report (PRA) to provide an overview of your email traffic. The report only includes malicious emails. Spam and bulk emails are not included. - -To generate a phishing risk assessment report: - -1. Log in to [Zero Trust](https://one.dash.cloudflare.com/). -2. Select **Monitoring**. -3. Select **Generate summary report**. -4. Select **Generate and download**. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/search-inbox.mdx b/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/search-inbox.mdx deleted file mode 100644 index 6826b950bcc3bfe..000000000000000 --- a/src/content/docs/learning-paths/secure-o365-email/pre-production-deployment/search-inbox.mdx +++ /dev/null @@ -1,14 +0,0 @@ ---- -title: Search through your inbox -pcx_content_type: how-to -sidebar: - order: 3 ---- - -With Email Security, you can use different screen criteria to search through your email inbox.There are three to scan through your email inbox: - -- **Popular screen**: Allows you to view messages based on common pre-defined criteria. -- **Regular screen**: Allows you to investigate your inbox by inserting a term to screen across all criteria. -- **Advanced screen**: Allows you to narrow message results based on specific criteria. - -Refer to [Search email](/cloudflare-one/insights/email-monitoring/search-email/) for advanced documentation. \ No newline at end of file diff --git a/src/content/partials/learning-paths/zero-trust/email-dispositions.mdx b/src/content/partials/learning-paths/zero-trust/email-dispositions.mdx new file mode 100644 index 000000000000000..639503b0f5db4bd --- /dev/null +++ b/src/content/partials/learning-paths/zero-trust/email-dispositions.mdx @@ -0,0 +1,12 @@ +--- +{} + +--- + +| Disposition | Description | Recommendation | | +|-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------|---| +| MALICIOUS | Traffic invoked multiple phishing verdict triggers, met thresholds for bad behavior, and is associated with active campaigns. | Block | | +| SUSPICIOUS | Traffic associated with phishing campaigns (and is under further analysis by our automated systems). | Research these messages internally to evaluate legitimacy. | | +| SPOOF | Traffic associated with phishing campaigns that is either non-compliant with your email authentication policies (SPF, DKIM, DMARC) or have mismatching Envelope From and Header From values. | Block after investigating (can be triggered by third-party mail services). | | +| SPAM | Traffic associated with non-malicious, commercial campaigns. | Route to existing Spam quarantine folder. | | +| BULK | Traffic associated with Graymail, that falls in between the definitions of SPAM and SUSPICIOUS. For example, a marketing email that intentionally obscures its unsubscribe link. | Monitor or tag | | \ No newline at end of file From c03652f4b8eb4b7fb98fa41d85ddf8781178413e Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Thu, 5 Dec 2024 11:04:14 +0000 Subject: [PATCH 15/21] Reverting unneccessary change --- .../zero-trust-web-access/access-application/best-practices.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/learning-paths/zero-trust-web-access/access-application/best-practices.mdx b/src/content/docs/learning-paths/zero-trust-web-access/access-application/best-practices.mdx index 822ed84e9dd94d2..88e47ccf4ca2342 100644 --- a/src/content/docs/learning-paths/zero-trust-web-access/access-application/best-practices.mdx +++ b/src/content/docs/learning-paths/zero-trust-web-access/access-application/best-practices.mdx @@ -24,4 +24,4 @@ Access applications have an inherently flexible and powerful domain structure ca Many customers who have workflows designed around internal web applications, especially those that were built internally, often see challenges related to interdependencies on multiple internal services. Separately, there can be challenges related to SPAs (Single-Page Applications) that make onboarding to a Zero Trust Web Access service difficult. For example, an application may have iFrames or other embedded systems that rely on different internal and/or external addresses. -If your internal service operates in this way, we recommend specifying multiple top-level domains in a single Access application. Otherwise, if the goal of using multiple domains is to streamline or simplify policy creation, we recommend making one primary domain per application, and automating the rest of your deployment [using Terraform](/learning-paths/zero-trust-web-access/terraform/) or another Infrastructure as Code (IaC) service. \ No newline at end of file +If your internal service operates in this way, we recommend specifying multiple top-level domains in a single Access application. Otherwise, if the goal of using multiple domains is to streamline or simplify policy creation, we recommend making one primary domain per application, and automating the rest of your deployment [using Terraform](/learning-paths/zero-trust-web-access/terraform/) or another Infrastructure as Code (IaC) service. From 44fdc0625d5e10673fbb9235621eddb66bfed6e6 Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Thu, 5 Dec 2024 11:07:38 +0000 Subject: [PATCH 16/21] Remove vs code change --- .vscode/settings.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.vscode/settings.json b/.vscode/settings.json index 3db80df4eb78452..2f50be09c286fba 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -3,6 +3,5 @@ "editor.formatOnSave": true, "editor.defaultFormatter": "esbenp.prettier-vscode", "typescript.tsdk": "node_modules/typescript/lib", - "cSpell.enableFiletypes": ["mdx"], - "editor.wordWrap": "on" + "cSpell.enableFiletypes": ["mdx"] } From 5345d11b7ae808bb0d08bb3ca096305a021868dd Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Thu, 5 Dec 2024 14:47:36 +0000 Subject: [PATCH 17/21] Typos and rewording --- .../concepts/protect-from-phishing-attacks.mdx | 2 +- .../secure-o365-email/concepts/what-is-email-security.mdx | 2 +- .../concepts/what-is-phishing-attack.mdx | 2 +- .../configure-email-security/active-directory-sync.mdx | 6 +++--- .../configure-email-security/create-allow-policies.mdx | 2 +- .../configure-email-security/impersonation-registry.mdx | 4 ++-- .../configure-email-security/report-phish.mdx | 2 +- .../secure-o365-email/enable-auto-moves/index.mdx | 4 +++- .../get-started/create-email-security-account.mdx | 4 +++- .../get-started/recommended-deployment-model.mdx | 4 ++-- .../secure-o365-email/monitor-your-inbox/index.mdx | 2 +- .../monitor-your-inbox/monitor-detections.mdx | 2 +- .../monitor-your-inbox/phish-submissions.mdx | 8 ++------ .../secure-o365-email/monitor-your-inbox/phishguard.mdx | 4 +++- 14 files changed, 25 insertions(+), 23 deletions(-) diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/protect-from-phishing-attacks.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/protect-from-phishing-attacks.mdx index bb2f22ebeed1a6e..60677706f8c1f65 100644 --- a/src/content/docs/learning-paths/secure-o365-email/concepts/protect-from-phishing-attacks.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/protect-from-phishing-attacks.mdx @@ -11,6 +11,6 @@ Continuously updating manual rulesets and policies that were originally built fo As organizations continue to adopt Microsoft 365 to enhance communication and collaboration for their hybrid workforce, it is crucial to take advantage of Microsoft's native security features while integrating complementary, machine learning-based solutions to automatically block and isolate the most dangerous threats. This strategy not only significantly reduces phishing risk, but also simplifies workflows, minimizing the time and effort needed for ongoing security management. -Analysts agree that consolidating capabilities to minimize overlapping functionality is helping organizations reduce cost and complexity. However, they also advise organization's to carefully assess native features to ensure they satisfy all use cases. As Microsoft continues to build out its essential email security features, the growing overlap with SEGs has given organizations an opportunity to streamline security operations by leveraging capabilities already included in their E3 or E5 license. +Analysts agree that consolidating capabilities to minimize overlapping functionality is helping organizations reduce cost and complexity. However, they also advise organizations to carefully assess native features to ensure they satisfy all use cases. As Microsoft continues to build out its essential email security features, the growing overlap with SEGs has given organizations an opportunity to streamline security operations by leveraging capabilities already included in their E3 or E5 license. This shift enables organizations to eliminate complex and costly SEG deployments, redirecting a fraction of that budget to integrate lightweight solutions that effectively address the most dangerous phishing threats. Cloudflare Email Security provides an integrated, low-touch solution that augments Microsoft 365 using machine learning threat analysis to automate the detection of BEC and multi-channel attacks. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx index 62ca3484ecd762b..53a047fa1f054f0 100644 --- a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx @@ -5,6 +5,6 @@ sidebar: order: 4 --- -Despite email's importance as a communication method, security and privacy were not built into the [The Simple Mail Transfer Protocol (SMTP) protocol](https://www.cloudflare.com/learning/email-security/what-is-smtp/) As a result, email is a major attack vector. +Despite email's importance as a communication method, security and privacy were not built into the [The Simple Mail Transfer Protocol (SMTP) protocol](https://www.cloudflare.com/learning/email-security/what-is-smtp/). As a result, email is a major attack vector. Email security is the process of preventing [email-based](https://www.cloudflare.com/learning/email-security/what-is-email/) cyber attacks and unwanted communications. It spans protecting inboxes from takeover, protecting domains from [spoofing](https://www.cloudflare.com/learning/ssl/what-is-domain-spoofing/), stopping [phishing attacks](https://www.cloudflare.com/learning/access-management/phishing-attack/), preventing fraud, blocking [malware](https://www.cloudflare.com/learning/ddos/glossary/malware/) delivery and filtering [spam](https://www.cloudflare.com/learning/email-security/how-to-stop-spam-emails/). \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx index 2880fe280e122a4..3eac32053a8d25a 100644 --- a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx @@ -5,7 +5,7 @@ sidebar: order: 3 --- -[Phishing](https://www.cloudflare.com/en-gb/learning/access-management/phishing-attack/) is an attempt to steal sensitive data, typically in the form of usernames, passwords, or other important account information. The phisher either uses the stolen information themselves, for instance to take over the user's accounts with their password, or sells the stolen information. +[Phishing](https://www.cloudflare.com/en-gb/learning/access-management/phishing-attack/) is an attempt to steal sensitive data, typically in the form of usernames, passwords, or other important account information. The phisher either uses the stolen information themselves (for instance, to take over the user's accounts with their password), or sells the stolen information. Phishing attackers disguise themselves as a reputable source. With an enticing or seemingly urgent request, an attacker lures the victim into providing information, just as a person uses bait while fishing. diff --git a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/active-directory-sync.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/active-directory-sync.mdx index d62fcfcfad3bd85..b36746c40f5fdd6 100644 --- a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/active-directory-sync.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/active-directory-sync.mdx @@ -33,6 +33,6 @@ To add multiple groups to the registry at once: In addition, Email Security allows you to: -- [Remove groups from the registry](/cloudflare-one/email-security/directories/manage-ms-directories/manage-groups-directory/#remove-groups-from-registry) -- [Filter the impersonation registry](/cloudflare-one/email-security/directories/manage-ms-directories/manage-groups-directory/#filter-impersonation-registry) -- [Manage users in your directory](/cloudflare-one/email-security/directories/manage-ms-directories/manage-users-directory/) \ No newline at end of file +- [Remove groups from the registry](/cloudflare-one/email-security/directories/manage-ms-directories/manage-groups-directory/#remove-groups-from-registry). +- [Filter the impersonation registry](/cloudflare-one/email-security/directories/manage-ms-directories/manage-groups-directory/#filter-impersonation-registry). +- [Manage users in your directory](/cloudflare-one/email-security/directories/manage-ms-directories/manage-users-directory/). \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx index 750dc664742c9e7..f7330a3a1796c2e 100644 --- a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx @@ -10,7 +10,7 @@ Email Security allows you to configure allow policies. An allow policy exempts m You can choose how Email Security will handle messages that match your criteria: - **Trusted Sender**: Messages will bypass all [detections](/cloudflare-one/email-security/reference/dispositions-and-attributes/) and link following by Email Security. Typically, it only applies to phishing simulations from vendors such as KnowBe4. -- **Exempt Recipient**: Will exempt messages from all Email Security [detections](/cloudflare-one/email-security/reference/dispositions-and-attributes/) intended for recipients matching this pattern (email address or regular expression only). Typically, this only applies to submission mailboxes for user reporting to security. +- **Exempt Recipient**: Messages will be exempt from all Email Security [detections](/cloudflare-one/email-security/reference/dispositions-and-attributes/) intended for recipients matching this pattern (email address or regular expression only). Typically, this only applies to submission mailboxes for user reporting to security. - **Acceptable Sender**: Will exempt messages from the `SPAM`, `SPOOF`, and `BULK` [dispositions](/cloudflare-one/email-security/reference/dispositions-and-attributes/) (but not `MALICIOUS` or `SUSPICIOUS`). Commonly used for external domains and sources that send mail on behalf of your organization, such as marketing emails or internal tools. ## Configure allow policies diff --git a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/impersonation-registry.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/impersonation-registry.mdx index 5e3e7fbfcf60799..37fef256992b1c7 100644 --- a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/impersonation-registry.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/impersonation-registry.mdx @@ -5,9 +5,9 @@ sidebar: order: 3 --- -Attackers often try to impersonate executives within an organization when sending malicious emails (with requests about banking information, trade secrets, and more), which is known as a Business Email Compromise (BEC) attack . +Attackers often try to impersonate executives within an organization when sending malicious emails (with requests about banking information, trade secrets, and more), which is known as a [Business Email Compromise (BEC)](https://www.cloudflare.com/en-gb/learning/email-security/business-email-compromise-bec/) attack . -This feature protects against these attacks by looking for spoofs of known key users in an organization . Information about key users you either synced with your directory or entered manually in the dashboard is used by Email Security to run enhanced scan techniques and find these spoofed emails. +The impersonation registry protects against these attacks by looking for spoofs of known key users in an organization. Information about key users you either synced with your directory or entered manually in the dashboard is used by Email Security to run enhanced scan techniques and find these spoofed emails. To add a user to the impersonation registry: diff --git a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/report-phish.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/report-phish.mdx index 7018dbb598b0529..4a40dd6c5e4a2d5 100644 --- a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/report-phish.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/report-phish.mdx @@ -7,7 +7,7 @@ sidebar: Before deploying Email Security to production, you will have to consider reporting any phishing attacks, evaluating which disposition to assign a specific message, and using different screen criteria to search through your inbox. -PhishNet is an add-in button that helps users to submit directly to Email Security phish samples missed by Email Security detection. +PhishNet is an add-in button that helps users to submit phish samples missed by Email Security detection. To set up PhishNet O365: diff --git a/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx b/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx index d26c9b4244c0873..25f7b2924733902 100644 --- a/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx @@ -5,4 +5,6 @@ sidebar: order: 4 --- -When you set up auto-moves, you can move messages manually or set up automatic moves to send messages matching certain [dispositions](/learning-paths/secure-o365-email/enable-auto-moves/email-dispositions/) to specific folders within a user's mailbox. You can also enable Post Delivery Response and Phish Submission Response to re-evaluate messages previously delivered against new information gathered by Email Security. Scanned emails that were previously delivered and now match this new phishing information will be moved. \ No newline at end of file +When you set up auto-moves, you can move messages manually or set up automatic moves to send messages matching certain [dispositions](/learning-paths/secure-o365-email/enable-auto-moves/email-dispositions/) to specific folders within a user's mailbox. + +You can also enable Post Delivery Response and Phish Submission Response to re-evaluate messages previously delivered against new information gathered by Email Security. Scanned emails that were previously delivered and now match this new phishing information will be moved. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx index d273e6180b01502..fd0b0e2a34adac7 100644 --- a/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/create-email-security-account.mdx @@ -9,7 +9,9 @@ To create your Email Security account, you will need the alphanumeric string on If you do not have a Cloudflare account, you can create one for free by referring to the [Cloudflare sign-up page](https://dash.cloudflare.com/sign-up). -From there, your account team will create an Email Security account for you. To establish your tenant, you will need the following information: +Once you have created your account, your account team will create an Email Security account for you. + +To establish your tenant, you will need the following information: - Average monthly inbound message volume - Number of active email users diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx index 252c3a9b1c96dab..870987815def623 100644 --- a/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/recommended-deployment-model.mdx @@ -10,7 +10,7 @@ An API deployment model with Email Security has multiple benefits for Microsoft The API deployment with Email Security offers: - Easy protection for complex email architectures, without requiring any change to mail flow operations. -- Agentless deployment for Microsoft O365. -- Office 365 directory integration to retrieve user and group information and prevent user impersonation. +- Agentless deployment for Microsoft 365. +- Office 365 directory integration to retrieve user and group information and prevent user impersonation. ![Microsoft 365 API deployment diagram](~/assets/images/learning-paths/secure-o365-email/ms365-api-deployment.png) \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/index.mdx b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/index.mdx index 682cf5b2c38ed92..26abe5f2bdbab5f 100644 --- a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/index.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/index.mdx @@ -24,4 +24,4 @@ The dashboard will display the following metrics: Email activity aggregates statistics about emails scanned and dispositions assigned (the number of email flagged due to a detection) within a given timeframe. -To view the live number of email scanned and dispositions scanned, enable **Live mode**. +To view the live number of email scanned and dispositions scanned, enable **Live mode**. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx index a3b0965398252e1..d28402e60b5fd2e 100644 --- a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx @@ -7,7 +7,7 @@ sidebar: Spam and Malicious emails are blocked outright by Email Security, but suspicious and spoof dispositions should be monitored. Suspicious messages should be investigated by a security analyst to determine the legitimacy of the message. -[PhishGuard](/cloudflare-one/email-security/phish-guard/), Cloudflare's managed email security service can review these messages for you and move them from the end user inbox if they are deemed malicious. +[PhishGuard](/cloudflare-one/email-security/phish-guard/) (Cloudflare's managed email security service) can review these messages for you and move them from the end user inbox if they are deemed malicious. Messages that receive a Spoof disposition should be investigated as well because it signals that the traffic is either non-compliant with your email authentication process [SPF](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-spf-record/), [DKIM](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dkim-record/), [DMARC](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dmarc-record/), or has a mismatching Envelope From and Header From value. diff --git a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phish-submissions.mdx b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phish-submissions.mdx index 326719ff1d4e85b..071b52ef6c57646 100644 --- a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phish-submissions.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phish-submissions.mdx @@ -5,7 +5,7 @@ sidebar: order: 3 --- -While Email Security offers industry leading detection efficacy due to Cloudflare's Threat Intelligence, Preemptive Threat Hunting (actor and campaign infrastructure hunting with 8B, plus campaign threat signals assessed every day) and ML-Based Detection Models (Trust Graphs Computer Vision, Sentiment/Thread/ Structural Analysis, Industry/Natural Language Understanding Modeling) false negatives and false positive can occur. +While Email Security offers industry leading detection efficacy due to Cloudflare's Threat Intelligence, Preemptive Threat Hunting (actor and campaign infrastructure hunting with 8B, plus campaign threat signals assessed every day) and ML-Based Detection Models (Trust Graphs Computer Vision, Sentiment/Thread/Structural Analysis, Industry/Natural Language Understanding Modeling) false negatives and false positive can occur. There are two different ways to [submit a phish](/cloudflare-one/insights/email-monitoring/phish-submissions/) sample: @@ -14,8 +14,4 @@ There are two different ways to [submit a phish](/cloudflare-one/insights/email- - User submissions can create another challenge for your organization. While it is important for end users to be vigilant and report what they believe may be a phishing email, they are often wrong. About 90% of the time, when an end user reports a missed phishing email, they are mistaken. This puts an extra burden on busy security teams as they sift through end user reports. The PhishGuard team at Cloudflare can solve this problem for your organization by reviewing end user submissions for you. - Admin submission: - To be used when IT administrators or security teams submit to Email Security. Submit original phish samples as an attachment in EML format to the appropriate team submission address. - - Within the Email Security dashboard, Phish submissions will allow you to have a full understanding of what reclassification has been made and what the outcomes of those submissions are. - -## Importance of submissions for Machine Learning Models - -## Sanitation of EML submission \ No newline at end of file + - Within the Email Security dashboard, Phish submissions will allow you to have a full understanding of what reclassification has been made and what the outcomes of those submissions are. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phishguard.mdx b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phishguard.mdx index 591a56946ad06db..78c4881fe6e6876 100644 --- a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phishguard.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phishguard.mdx @@ -17,4 +17,6 @@ sidebar: As a PhishGuard customer, the following service offerings should be enabled: - Escalation contacts must be configured in the Email Security dashboard: This allows for email reports to be delivered regarding high risk items identified and responded to by the team. -- Auto-moves should be enabled and configured for quarantine of identified items: `MALICIOUS` should be prioritized, but configuring Spam for a move to junk/trash or even soft delete may also be highly useful to the client. \ No newline at end of file +- Auto-moves should be enabled and configured for quarantine of identified items: `MALICIOUS` should be prioritized, but configuring Spam for a move to junk/trash or even soft delete may also be highly useful to the client. + +Refer to the [PhishGuard](/cloudflare-one/email-security/phish-guard/) documentation to learn more about this add-on service. \ No newline at end of file From a2ecb9b4974764653973613770124e709be1aa7b Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Thu, 5 Dec 2024 16:43:13 +0000 Subject: [PATCH 18/21] Reorder pages, change content type, adding set up api page, add subheading, add links for seo --- .../configure-email-security/audit-logs.mdx | 2 +- .../create-allow-policies.mdx | 2 +- .../configure-email-security/index.mdx | 4 +++- .../configure-email-security/report-phish.mdx | 2 +- .../set-additional-detections.mdx | 2 +- .../configure-auto-moves.mdx | 2 +- .../enable-auto-moves/index.mdx | 8 ++++++++ .../get-started/setup-ms-graph-api.mdx | 19 +++++++++++++++++++ .../monitor-your-inbox/monitor-detections.mdx | 2 ++ .../zero-trust/email-dispositions.mdx | 4 ++-- 10 files changed, 39 insertions(+), 8 deletions(-) create mode 100644 src/content/docs/learning-paths/secure-o365-email/get-started/setup-ms-graph-api.mdx diff --git a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/audit-logs.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/audit-logs.mdx index 6e996cae4476813..c4e4e3a6159c833 100644 --- a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/audit-logs.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/audit-logs.mdx @@ -2,7 +2,7 @@ title: Enable audit logs pcx_content_type: how-to sidebar: - order: 4 + order: 6 --- With Email Security, you can enable logs to review actions performed on your account. diff --git a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx index f7330a3a1796c2e..8dc4368ca17f9cb 100644 --- a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx @@ -2,7 +2,7 @@ title: Create allow policies pcx_content_type: how-to sidebar: - order: 4 + order: 3 --- Email Security allows you to configure allow policies. An allow policy exempts messages that match certain patterns from normal detection scanning. diff --git a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/index.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/index.mdx index dc919b3c41763ea..80656a96ff8ea4d 100644 --- a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/index.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/index.mdx @@ -5,4 +5,6 @@ sidebar: order: 3 --- -With Email Security, there is limited manual configuration and tuning. The Active Directory sync, allow policies, and additional detections are important to consider when you set up Email Security. \ No newline at end of file +With Email Security, there is limited manual configuration and tuning. The Active Directory sync, allow policies, and additional detections are important to consider when you set up Email Security. + +In this module, you will configure your email environment. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/report-phish.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/report-phish.mdx index 4a40dd6c5e4a2d5..2a5249853d98aea 100644 --- a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/report-phish.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/report-phish.mdx @@ -2,7 +2,7 @@ title: Report phish pcx_content_type: how-to sidebar: - order: 4 + order: 5 --- Before deploying Email Security to production, you will have to consider reporting any phishing attacks, evaluating which disposition to assign a specific message, and using different screen criteria to search through your inbox. diff --git a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/set-additional-detections.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/set-additional-detections.mdx index 2ce1f44c4a9f0e3..50491782c6a44d8 100644 --- a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/set-additional-detections.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/set-additional-detections.mdx @@ -2,7 +2,7 @@ title: Set additional detections pcx_content_type: how-to sidebar: - order: 5 + order: 4 --- Email Security allows you to configure the following additional detections: diff --git a/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/configure-auto-moves.mdx b/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/configure-auto-moves.mdx index f490911955b3c23..19ff3c47a24a030 100644 --- a/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/configure-auto-moves.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/configure-auto-moves.mdx @@ -1,6 +1,6 @@ --- title: Configure auto-moves -pcx_content_type: overview +pcx_content_type: how-to sidebar: order: 3 --- diff --git a/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx b/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx index 25f7b2924733902..5e9f4ea72dbd67c 100644 --- a/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx @@ -5,6 +5,14 @@ sidebar: order: 4 --- +Now that you have set up your email environment, you can enable auto-move events. + +:::caution +Ensure you have completed the previous modules before enabling auto-moves. +::: + +Auto-move events are events where emails are automatically moved to different inboxes based on the disposition Email Security assigned to them. + When you set up auto-moves, you can move messages manually or set up automatic moves to send messages matching certain [dispositions](/learning-paths/secure-o365-email/enable-auto-moves/email-dispositions/) to specific folders within a user's mailbox. You can also enable Post Delivery Response and Phish Submission Response to re-evaluate messages previously delivered against new information gathered by Email Security. Scanned emails that were previously delivered and now match this new phishing information will be moved. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/setup-ms-graph-api.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/setup-ms-graph-api.mdx new file mode 100644 index 000000000000000..0568401a29c5895 --- /dev/null +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/setup-ms-graph-api.mdx @@ -0,0 +1,19 @@ +--- +title: Set up Microsoft Graph API +pcx_content_type: overview +sidebar: + order: 6 +--- + +1. Log in to [Zero Trust](https://one.dash.cloudflare.com/). +2. Select **Email Security**. +3. Select **Monitoring**. +4. Enable **Microsoft Integration**: + 1. **Name integration**: Add your integration name, then select **Continue**. + 2. **Authorize integration**: + - Select **Authorize**. Selecting **Authorize** will take you to the Microsoft Sign in page where you will have to enter your email address. + - Once you enter your email address, select **Next**. + - After selecting **Next**, the system will show a dialog box with a list of requested permissions. Select **Accept** to authorize Email Security. Upon authorization, you will be redirected to a page where you can review details and enroll integration. + 3. **Review details**: Review your integration details, then: + - Select **Complete Email Security set up** where you will be able to connect your domains and configure auto-moves. + - Select **Continue to Email Security**. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx index d28402e60b5fd2e..97a002ef469c1b4 100644 --- a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx @@ -30,4 +30,6 @@ There are three ways for searching emails: Additional information on search can be found on the [Screen criteria](/email-security/reporting/search/) documentation. +### Export messages + With Email Security, you can export messages to a CSV file. Via the dashboard, you can export up to 1,000 rows. If you want to export all messages, you can use the [API](https://developers.cloudflare.com/api/operations/email_security_get_message). \ No newline at end of file diff --git a/src/content/partials/learning-paths/zero-trust/email-dispositions.mdx b/src/content/partials/learning-paths/zero-trust/email-dispositions.mdx index 639503b0f5db4bd..eb7923cc01c53a6 100644 --- a/src/content/partials/learning-paths/zero-trust/email-dispositions.mdx +++ b/src/content/partials/learning-paths/zero-trust/email-dispositions.mdx @@ -7,6 +7,6 @@ |-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------|---| | MALICIOUS | Traffic invoked multiple phishing verdict triggers, met thresholds for bad behavior, and is associated with active campaigns. | Block | | | SUSPICIOUS | Traffic associated with phishing campaigns (and is under further analysis by our automated systems). | Research these messages internally to evaluate legitimacy. | | -| SPOOF | Traffic associated with phishing campaigns that is either non-compliant with your email authentication policies (SPF, DKIM, DMARC) or have mismatching Envelope From and Header From values. | Block after investigating (can be triggered by third-party mail services). | | +| SPOOF | Traffic associated with phishing campaigns that is either non-compliant with your email authentication policies ([SPF](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-spf-record/), [DKIM](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dkim-record/), [DMARC](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dmarc-record/)) or have mismatching Envelope From and Header From values. | Block after investigating (can be triggered by third-party mail services). | | | SPAM | Traffic associated with non-malicious, commercial campaigns. | Route to existing Spam quarantine folder. | | -| BULK | Traffic associated with Graymail, that falls in between the definitions of SPAM and SUSPICIOUS. For example, a marketing email that intentionally obscures its unsubscribe link. | Monitor or tag | | \ No newline at end of file +| BULK | Traffic associated with [Graymail](https://en.wikipedia.org/wiki/Graymail), that falls in between the definitions of SPAM and SUSPICIOUS. For example, a marketing email that intentionally obscures its unsubscribe link. | Monitor or tag | | \ No newline at end of file From 6f08c611d358960e37fd9248f5f78a1003d6be7e Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Fri, 6 Dec 2024 11:46:56 +0000 Subject: [PATCH 19/21] Adding clarity + correcting typos --- .../monitor-your-inbox/monitor-detections.mdx | 8 ++++---- .../secure-o365-email/monitor-your-inbox/phishguard.mdx | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx index 97a002ef469c1b4..d871a8790bec39c 100644 --- a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx @@ -5,13 +5,13 @@ sidebar: order: 2 --- -Spam and Malicious emails are blocked outright by Email Security, but suspicious and spoof dispositions should be monitored. Suspicious messages should be investigated by a security analyst to determine the legitimacy of the message. +Spam and Malicious emails are blocked outright by Email Security, but Suspicious and Spoof dispositions should be monitored. Suspicious messages should be investigated by a security analyst to determine the legitimacy of the message. [PhishGuard](/cloudflare-one/email-security/phish-guard/) (Cloudflare's managed email security service) can review these messages for you and move them from the end user inbox if they are deemed malicious. -Messages that receive a Spoof disposition should be investigated as well because it signals that the traffic is either non-compliant with your email authentication process [SPF](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-spf-record/), [DKIM](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dkim-record/), [DMARC](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dmarc-record/), or has a mismatching Envelope From and Header From value. +Messages that receive a Spoof disposition should be investigated because it signals that the traffic is either non-compliant with your email authentication process [SPF](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-spf-record/), [DKIM](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dkim-record/), [DMARC](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dmarc-record/), or has a mismatching Envelope From and Header From value. -In most cases, this disposition is triggered by a legitimate third-party mail service. If you determine that the Spoofed email is a legitimate business use case, you can either: +In most cases, a Spoof disposition is triggered by a legitimate third-party mail service. If you determine that the Spoofed email is a legitimate business use case, you can either: - Update your email authentication records. - Add an acceptable sender [allow policy](/cloudflare-one/email-security/detection-settings/allow-policies/) to exempt messages from the Spam, Spoof or Bulk disposition, but not Malicious or Suspicious, so the content of the message can still be monitored. @@ -20,7 +20,7 @@ In most cases, this disposition is triggered by a legitimate third-party mail se Email Security offers a variety of ways for you to better examine and understand your message traffic: -You can search for emails that have been processed by Email Security, whether they are marked with a[ detection disposition](/email-security/reference/dispositions-and-attributes/) or not. +You can search for emails that have been processed by Email Security, whether they are marked with a [detection disposition](/email-security/reference/dispositions-and-attributes/) or not. There are three ways for searching emails: diff --git a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phishguard.mdx b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phishguard.mdx index 78c4881fe6e6876..dc1a24a2441cca3 100644 --- a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phishguard.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/phishguard.mdx @@ -17,6 +17,6 @@ sidebar: As a PhishGuard customer, the following service offerings should be enabled: - Escalation contacts must be configured in the Email Security dashboard: This allows for email reports to be delivered regarding high risk items identified and responded to by the team. -- Auto-moves should be enabled and configured for quarantine of identified items: `MALICIOUS` should be prioritized, but configuring Spam for a move to junk/trash or even soft delete may also be highly useful to the client. +- Auto-moves should be enabled and configured for quarantine of identified items: Malicious should be prioritized, but configuring Spam for a move to junk/trash or even soft delete may also be highly useful to the client. Refer to the [PhishGuard](/cloudflare-one/email-security/phish-guard/) documentation to learn more about this add-on service. \ No newline at end of file From 27e7eb8f68bcb56e7b80c7740c8d1ed416231976 Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Fri, 6 Dec 2024 14:29:11 +0000 Subject: [PATCH 20/21] Apply suggestions from code review Co-authored-by: Jun Lee --- .../secure-o365-email/concepts/what-is-email-security.mdx | 2 +- .../secure-o365-email/concepts/what-is-phishing-attack.mdx | 2 +- .../secure-o365-email/configure-email-security/audit-logs.mdx | 2 +- .../configure-email-security/create-allow-policies.mdx | 2 +- .../configure-email-security/impersonation-registry.mdx | 2 +- .../secure-o365-email/enable-auto-moves/email-dispositions.mdx | 2 +- .../secure-o365-email/enable-auto-moves/index.mdx | 2 +- .../docs/learning-paths/secure-o365-email/get-started/index.mdx | 2 +- .../secure-o365-email/get-started/initial-login.mdx | 2 +- .../secure-o365-email/monitor-your-inbox/index.mdx | 2 +- .../secure-o365-email/monitor-your-inbox/monitor-detections.mdx | 2 +- .../partials/learning-paths/zero-trust/email-dispositions.mdx | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx index 53a047fa1f054f0..89e52c4905e0b21 100644 --- a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-email-security.mdx @@ -7,4 +7,4 @@ sidebar: Despite email's importance as a communication method, security and privacy were not built into the [The Simple Mail Transfer Protocol (SMTP) protocol](https://www.cloudflare.com/learning/email-security/what-is-smtp/). As a result, email is a major attack vector. -Email security is the process of preventing [email-based](https://www.cloudflare.com/learning/email-security/what-is-email/) cyber attacks and unwanted communications. It spans protecting inboxes from takeover, protecting domains from [spoofing](https://www.cloudflare.com/learning/ssl/what-is-domain-spoofing/), stopping [phishing attacks](https://www.cloudflare.com/learning/access-management/phishing-attack/), preventing fraud, blocking [malware](https://www.cloudflare.com/learning/ddos/glossary/malware/) delivery and filtering [spam](https://www.cloudflare.com/learning/email-security/how-to-stop-spam-emails/). \ No newline at end of file +Email security is the process of preventing [email-based](https://www.cloudflare.com/learning/email-security/what-is-email/) cyber attacks and unwanted communications. It spans protecting inboxes from takeover, protecting domains from [spoofing](https://www.cloudflare.com/learning/ssl/what-is-domain-spoofing/), stopping [phishing attacks](https://www.cloudflare.com/learning/access-management/phishing-attack/), preventing fraud, blocking [malware](https://www.cloudflare.com/learning/ddos/glossary/malware/) delivery, and filtering [spam](https://www.cloudflare.com/learning/email-security/how-to-stop-spam-emails/). \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx index 3eac32053a8d25a..d11afccaa835fb0 100644 --- a/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/concepts/what-is-phishing-attack.mdx @@ -9,4 +9,4 @@ sidebar: Phishing attackers disguise themselves as a reputable source. With an enticing or seemingly urgent request, an attacker lures the victim into providing information, just as a person uses bait while fishing. -Phishing often takes place over email. Phishers either try to trick people into emailing information directly, or link to a webpage they control that is designed to look legitimate (for instance, a fake login page where the user enters their password). \ No newline at end of file +Phishing often takes place over email. Phishers either try to trick people into emailing information directly, or link to a webpage they control that is designed to look legitimate (for instance, a fake login page where the victim enters their password). \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/audit-logs.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/audit-logs.mdx index c4e4e3a6159c833..6ffa3ce52a70952 100644 --- a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/audit-logs.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/audit-logs.mdx @@ -10,7 +10,7 @@ With Email Security, you can enable logs to review actions performed on your acc To enable audit logs: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/). -2. Select **Analytics & Logs** > Logpush. +2. Select **Analytics & Logs** > **Logpush**. 3. Select **Audit logs**. 4. **Under Configure logpush job**: - **Job name**: Enter the job name. diff --git a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx index 8dc4368ca17f9cb..9b78f08157e00a5 100644 --- a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx @@ -35,5 +35,5 @@ To configure allow policies: - **Regular expressions**: Must be valid Java expressions. Regular expressions are matched with fields related to the sender email address (envelope from, header from, reply-to), the originating IP address, and the server name for the email. - **(Recommended) Sender verification**: This option enforces DMARC, SPF, or DKIM authentication. If you choose to enable this option, Email Security will only honor policies that pass authentication. - **Notes**: Provide additional information about your allow policy. - - **Uploading an allow policy**: Upload a file no larger than 150 KB. The file can only contain `Pattern`, `Notes`, `Verify Email`, `Trusted Sender`, `Exempt Recipient` and `Acceptable Sender` fields. The first row must be a header row. + - **Uploading an allow policy**: Upload a file no larger than 150 KB. The file can only contain `Pattern`, `Notes`, `Verify Email`, `Trusted Sender`, `Exempt Recipient`, and `Acceptable Sender` fields. The first row must be a header row. 6. Select **Save**. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/impersonation-registry.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/impersonation-registry.mdx index 37fef256992b1c7..faea9903af79c00 100644 --- a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/impersonation-registry.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/impersonation-registry.mdx @@ -5,7 +5,7 @@ sidebar: order: 3 --- -Attackers often try to impersonate executives within an organization when sending malicious emails (with requests about banking information, trade secrets, and more), which is known as a [Business Email Compromise (BEC)](https://www.cloudflare.com/en-gb/learning/email-security/business-email-compromise-bec/) attack . +Attackers often try to impersonate executives within an organization when sending malicious emails (with requests about banking information, trade secrets, and more), which is known as a [Business Email Compromise (BEC)](https://www.cloudflare.com/en-gb/learning/email-security/business-email-compromise-bec/) attack. The impersonation registry protects against these attacks by looking for spoofs of known key users in an organization. Information about key users you either synced with your directory or entered manually in the dashboard is used by Email Security to run enhanced scan techniques and find these spoofed emails. diff --git a/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/email-dispositions.mdx b/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/email-dispositions.mdx index dfbf32cd9022d30..5d74a3d80a88c4e 100644 --- a/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/email-dispositions.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/email-dispositions.mdx @@ -7,6 +7,6 @@ sidebar: import { Render } from "~/components" -Email Security returns five potential verdicts for every email it scans. Review detections and consider how you would treat them once an auto-move is enabled. Below is an overview of the disposition and recommendation actions by Cloudflare: +Email Security returns five potential verdicts for every email it scans. Review the detections and consider how you would treat them once an auto-move is enabled. Below is an overview of the disposition and recommendation actions by Cloudflare: \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx b/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx index 5e9f4ea72dbd67c..ec29a686185823a 100644 --- a/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/enable-auto-moves/index.mdx @@ -11,7 +11,7 @@ Now that you have set up your email environment, you can enable auto-move events Ensure you have completed the previous modules before enabling auto-moves. ::: -Auto-move events are events where emails are automatically moved to different inboxes based on the disposition Email Security assigned to them. +Auto-move events are events where emails are automatically moved to different inboxes based on the disposition assigned to them by Email Security. When you set up auto-moves, you can move messages manually or set up automatic moves to send messages matching certain [dispositions](/learning-paths/secure-o365-email/enable-auto-moves/email-dispositions/) to specific folders within a user's mailbox. diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx index f6f82fcaa1c8c6f..366d3d0de6066a5 100644 --- a/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/index.mdx @@ -7,7 +7,7 @@ sidebar: In this learning path, you will learn how to protect your organization from phishing attacks with Email Security. -Your users will experience a reduction in spam and phishing emails and have simple ways to report any suspicious activity. +Your users will experience a reduction in spam and phishing emails, and have simple ways to report any suspicious activity. Administrators will be able to review detections and phishing trends that target their organization without having to tune Email Security. diff --git a/src/content/docs/learning-paths/secure-o365-email/get-started/initial-login.mdx b/src/content/docs/learning-paths/secure-o365-email/get-started/initial-login.mdx index 1b9224d53a72956..2741332182635e7 100644 --- a/src/content/docs/learning-paths/secure-o365-email/get-started/initial-login.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/get-started/initial-login.mdx @@ -7,4 +7,4 @@ sidebar: Once your tenant is created by your account team, you will receive an email that grants you access to the Email Security platform. -Multi-factor authentication is required, so you will need an authenticator tool to set up your second factor prior to gaining access. Scan the QR code, set up your second factor, create a new password and enter the Email Security portal. \ No newline at end of file +Multi-factor authentication is required, so you will need an authenticator tool to set up your second factor prior to gaining access. Scan the QR code, set up your second factor, create a new password, and enter the Email Security portal. \ No newline at end of file diff --git a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/index.mdx b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/index.mdx index 26abe5f2bdbab5f..a24125458fb285d 100644 --- a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/index.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/index.mdx @@ -5,7 +5,7 @@ sidebar: order: 5 --- -To access an overview of your account, total number of emails processed, a breakdown of types of threads detected, among other types of information: +To access an overview of your account, the total number of emails processed, a breakdown of types of threads detected, and other useful information: 1. Log in to [Zero Trust.](https://one.dash.cloudflare.com/) 2. Select **Email Security**. diff --git a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx index d871a8790bec39c..181c354cf751d0f 100644 --- a/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/monitor-your-inbox/monitor-detections.mdx @@ -14,7 +14,7 @@ Messages that receive a Spoof disposition should be investigated because it sign In most cases, a Spoof disposition is triggered by a legitimate third-party mail service. If you determine that the Spoofed email is a legitimate business use case, you can either: - Update your email authentication records. -- Add an acceptable sender [allow policy](/cloudflare-one/email-security/detection-settings/allow-policies/) to exempt messages from the Spam, Spoof or Bulk disposition, but not Malicious or Suspicious, so the content of the message can still be monitored. +- Add an acceptable sender [allow policy](/cloudflare-one/email-security/detection-settings/allow-policies/) to exempt messages from the Spam, Spoof, or Bulk disposition, but not Malicious or Suspicious, so the content of the message can still be monitored. ## Search email messages diff --git a/src/content/partials/learning-paths/zero-trust/email-dispositions.mdx b/src/content/partials/learning-paths/zero-trust/email-dispositions.mdx index eb7923cc01c53a6..d7a5d2a680983d6 100644 --- a/src/content/partials/learning-paths/zero-trust/email-dispositions.mdx +++ b/src/content/partials/learning-paths/zero-trust/email-dispositions.mdx @@ -7,6 +7,6 @@ |-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------|---| | MALICIOUS | Traffic invoked multiple phishing verdict triggers, met thresholds for bad behavior, and is associated with active campaigns. | Block | | | SUSPICIOUS | Traffic associated with phishing campaigns (and is under further analysis by our automated systems). | Research these messages internally to evaluate legitimacy. | | -| SPOOF | Traffic associated with phishing campaigns that is either non-compliant with your email authentication policies ([SPF](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-spf-record/), [DKIM](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dkim-record/), [DMARC](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dmarc-record/)) or have mismatching Envelope From and Header From values. | Block after investigating (can be triggered by third-party mail services). | | +| SPOOF | Traffic associated with phishing campaigns that is either non-compliant with your email authentication policies ([SPF](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-spf-record/), [DKIM](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dkim-record/), [DMARC](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dmarc-record/)), or have mismatching Envelope From and Header From values. | Block after investigating (can be triggered by third-party mail services). | | | SPAM | Traffic associated with non-malicious, commercial campaigns. | Route to existing Spam quarantine folder. | | | BULK | Traffic associated with [Graymail](https://en.wikipedia.org/wiki/Graymail), that falls in between the definitions of SPAM and SUSPICIOUS. For example, a marketing email that intentionally obscures its unsubscribe link. | Monitor or tag | | \ No newline at end of file From c6ed7bab8c0635110bf2768378808d062a2b9471 Mon Sep 17 00:00:00 2001 From: Maddy <130055405+Maddy-Cloudflare@users.noreply.github.com> Date: Fri, 6 Dec 2024 15:28:08 +0000 Subject: [PATCH 21/21] Applying suggestions --- .../secure-o365-email/configure-email-security/audit-logs.mdx | 2 +- .../configure-email-security/create-allow-policies.mdx | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/audit-logs.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/audit-logs.mdx index 6ffa3ce52a70952..30b8ad44c32e6bc 100644 --- a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/audit-logs.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/audit-logs.mdx @@ -12,7 +12,7 @@ To enable audit logs: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/). 2. Select **Analytics & Logs** > **Logpush**. 3. Select **Audit logs**. -4. **Under Configure logpush job**: +4. Under **Configure logpush job**: - **Job name**: Enter the job name. - **If logs match**: Select Filtered logs: - **Field**: Choose `ResourceType`. diff --git a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx index 9b78f08157e00a5..59f5889ac44918b 100644 --- a/src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx +++ b/src/content/docs/learning-paths/secure-o365-email/configure-email-security/create-allow-policies.mdx @@ -9,9 +9,9 @@ Email Security allows you to configure allow policies. An allow policy exempts m You can choose how Email Security will handle messages that match your criteria: -- **Trusted Sender**: Messages will bypass all [detections](/cloudflare-one/email-security/reference/dispositions-and-attributes/) and link following by Email Security. Typically, it only applies to phishing simulations from vendors such as KnowBe4. +- **Trusted Sender**: Messages will bypass all [detections](/cloudflare-one/email-security/reference/dispositions-and-attributes/) and link following. Typically, it only applies to phishing simulations from vendors such as KnowBe4. Many emails contain links in them. Some of these could be links to surveys, phishing simulations and other trackable links. By marking a message as a Trusted Sender, Email Security will not scan any attachments from the sender and will not attempt to open the links in the emails. - **Exempt Recipient**: Messages will be exempt from all Email Security [detections](/cloudflare-one/email-security/reference/dispositions-and-attributes/) intended for recipients matching this pattern (email address or regular expression only). Typically, this only applies to submission mailboxes for user reporting to security. -- **Acceptable Sender**: Will exempt messages from the `SPAM`, `SPOOF`, and `BULK` [dispositions](/cloudflare-one/email-security/reference/dispositions-and-attributes/) (but not `MALICIOUS` or `SUSPICIOUS`). Commonly used for external domains and sources that send mail on behalf of your organization, such as marketing emails or internal tools. +- **Accept Sender**: Messages will exempt messages from the `SPAM`, `SPOOF`, and `BULK` [dispositions](/cloudflare-one/email-security/reference/dispositions-and-attributes/) (but not `MALICIOUS` or `SUSPICIOUS`). Commonly used for external domains and sources that send mail on behalf of your organization, such as marketing emails or internal tools. ## Configure allow policies