SMX - How to set up Whaling Protection Rule

SMX - How to set up Whaling Protection Rule

Revisions
Revised by
Mike Migalbio
Nature of Update
Confirmed this is still active process
Date of Revision
25/10/2022

HOW TO:

How to set up Whaling Protection Rule

CUSTOMER DESCRIPTION

Assistance in setting up whaling for our customer

ENVIRONMENT

SMX


PROCESS

Whaling Protection Basic Setup Guide

The Whaling Protection rules look up a list of email recipients from a Whaling Targets list. The first step
in setting up Whaling Protection is to create this list.

To set up Whaling Protection, the following steps need to be executed in the order provided in this
document.

Step 1: Create the Whaling Targets list

The Whaling Protection (whale tail), which resides inside the SmartRules DLP relies on customers prepopulating
a list with the name and email addresses of the employees within the organisation who need
protecting from whaling attacks.

This list should contain the display names, including any titles configured in the sender's mail client, and
email addresses of all key financial decision makers. These are typically members of the C-Suite,
Executive Team, and key Finance personnel who are potential whaling or spear phishing targets whose
identities you want to protect from being spoofed.

1. From the SmartRules DLP tab, select the List Management sub-tab.

2. Select New List, a dialog box will pop-up.

3. In the Name field, type “Whaling Targets”. The whaling list must be called ‘Whaling Targets'.
The list can be left empty until a list of email addresses is provided. To complete the list follow
the next step.

4. In the Items field, populate the list of whaling targets for your company.
Examples of who should be in this list would include:
  1.  senior executives
  2.  board members
  3.  key finance decision makers

The format of the list is: Display Name <>, such as:


5. The Whaling Targets list should look like below. Save the list.

Note: This is a reseller’s view of the portal, customers would not have the Reseller tab.

The easiest way to get this data is to ask the user to send an email from all of the accounts they normally
utilize for work purposes (this can include non-company domains like a personal email address such as
gmail.com, outlook.com, etc.).

Once the list of names and addresses has been compiled, the Whaling Protection looks for emails
which match the Whaling Protection. The defined action for the rule will then trigger.

Note that emails that trigger the Whaling Protection will not be blocked. The default rule pre-pends
preamble text to the suspected whaling email to alert the recipient of the suspected whaling email.

Step 2: Create the Whaling Template

1. From the SmartRules DLP tab, select the Content Templates sub-tab.
2. Select the New Template button.
3. In the empty field, type “Whaling Template” and click on Save.
4. On the right hand panel, both Plain Text Template and HTML Template will need to be filled in.
5. The standard SMX Whaling Protection warning templates are below. You may customise your
own or copy paste these templates to the appropriate fields in the SMX portal.

Plain Text Template
Copy and paste this template into the plain text field
------------------------------------------------------------
WARNING!!!
[Suspected fraudulent email detected]
------------------------------------------------------------

HTML Template
Click the Source Edit the Preamble button before and after copying and pasting the code below into
the HTML field.
-------------------------------------------------------------------<br><font color="FF0000"><b><font
size="3">WARNING!!!<br></font></b></font>[Suspected<span style="font-size: 11pt; lineheight:
15.6933px; font-family: Calibri, sans-serif;"></span>&nbsp;fraudulent email
detected]<br>-------------------------------------------------------------------

6. The Whaling Template should look like below. Save the template.

Step 3: Create the Whaling Protection Rule

7. From the SmartRules DLP tab, select Inbound Rules sub-tab
8. Click on New Set > type in Whaling Rule > Save
9. Click on New SmartRule > select Empty SmartRule > click OK
10. In the Rule Name field, type Whaling Protection
  1.  Leave the description field empty
  2.  Leave the Enabled to No
11. From the first row of buttons, select the Suspected Whaling button  and drag to the space
below it. Release the button once the colour changes to green.

12. From the second row of buttons, click and drag the Preamble button. Release once the colour
changes to green.
13. In the prepend preamble, select the Whaling Template from the drop-down menu, click on
Save.

Review the rule to make sure the steps you have done are complete.
The complete rule in disabled state should look like below, you can either enable the rule or review it
again before enabling the rule.

14. To enable, double click on the rule, locate the Enabled field and select Yes from the dropdown
menu then click Save.

Important:
If there are any other SmartRules, the Whaling Protection will need to be moved to the top of the other
rule sets. This can be done by placing the pointer to the right and two arrows pointing up and down will
come up. Click and drag to the top.

     

    EST. TIME TO RESOLUTION

     20 mins



      • Related Articles

      • SMX - How to create Smart rules

        Revisions Revised by Mike Migalbio Nature of Update Confirmed this is still active process Date of Revision 13/10/2022 HOW TO:    How to create SMX smart rules CUSTOMER DESCRIPTION How can I set up SMX smart rules   ENVIRONMENT  SMX PROCESS ...
      • SMX - Smart Rules Basic Concepts

        Revisions Revised by Mike Migalbio Nature of Update Confirmed this is still active process Date of Revision 25/10/2022 HOW TO: Smart Rules Basic Concepts CUSTOMER DESCRIPTION Basic Concepts required for SMX ENVIRONMENT SMX PROCESS Basic SmartRules® ...
      • SMX -How to set up SMX Outbound Smart Rules

        Revisions Revised by Mike Migalbio Nature of Update Confirmed this is still active process Date of Revision 25/10/2022 HOW TO: How to set up SMX Outbound Rules  CUSTOMER DESCRIPTION How can I set up outbound smart rules   ENVIRONMENT SMX  PROCESS ...
      • SMX- How to set up Inbound Smart Rules

        Revisions Revised by Mike Migalbio Nature of Update Confirmed this is still active process Date of Revision 25/10/2022 HOW TO: SMX- How to set up Inbound Smart Rules CUSTOMER DESCRIPTION How do I set up inbound SMX rules   ENVIRONMENT SMX PROCESS ...
      • SMX - Maintaining content in Smart Rules

        Revisions Revised by Mike Migalbio Nature of Update Confirmed this is still active process Date of Revision 25/10/2022 HOW TO: SMX - Maintaining content in Smart Rules CUSTOMER DESCRIPTION How do we create templates for Smart rules ENVIRONMENT SMX ​ ...