We detect malicious content in various collaboration channels including cloud storage such as Dropbox, Microsoft OnwDrive, SharePoint, and Teams. 

We have just released support for Salesforce. Your organization can now protect itself from malicious files infiltrating the organization through Salesforce. You can also quarantine files and prevent access to them by end-users. 

Our Salesforce App can be found in the Salesforce Marketplace:

https://appexchange.salesforce.com/appxListingDetail?listingId=a0N4V00000GwHgtUAF&preview=%222021-11-22T14%3A35%3A54.000Z%22

We have added Malware Family classification as part of our HAP Analysis. It is possible to see it as part of the scan details.

The “Request Investigation” allows opening a ticket to Perception Point’s Incident Response team from the scan page, with an indication if you think the email is clean/malicious/spam.

As part of the request, a comment can be added. 

It is now possible to see the request details and the comment as part of the information in the scan details.

We detect malicious content in cloud storage applications all the time and quarantine is available for Dropbox, Microsoft OnwDrive, SharePoint, and Teams. 

Now, you can quarantine files and prevent access to them by end-users also in Google Drive. The quarantine folder can be configured, and the original file will be replaced by a text file. 

A new easier way to add new email domains is provided, as part of the configuration of a new service.

To configure an email service, in X-Ray toolbar, click on “Connect New Service”.

Choose your Email service, select your preferred connection method, and enter your domains. Once this information is available, you will be redirected to verify your domain TXT records with your email provider.

Once those are verified Perception Point’s team will assist with finalizing the setup with your email provider.

Reviewing scans and incidents is a pillar activity of X-Ray.

To better group and find the incidents you want to look at, a sorting option was added that enables sorting by the following fields:

• Time
• From
• To
• Name

Together with advanced filtering options, it gives more power to investigate and handle scans.

MITRE ATT&CK® (https://attack.mitre.org/) is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.

We have added an option to see the mapping of any content scanned by the system and the identified threats to the MITRE ATT&CK® model.

Details of the techniques and sub-techniques are provided to assist researchers with analyzing the threat.

The system comes with a flexible set of admin roles, allowing you to give the right permissions to each user.

We added roles of Cyber Expert and Self Analysis, resulting in better control of which user can do what.

The current set of roles include:

• Self Analysis. Upload files/URLs for analysis.
• Member. View scan information and upload files/URLs for analysis.
• Email Flow Manager. View scan information, upload files/URLs for analysis, and release emails.
• Cyber Analyst. View scan information, upload files/URLs for analysis and perform any action on a scan.
• Cyber Expert. View scan information, upload files/URLs for analysis, perform any action on a scan, and view settings.
• Admin. View scan information, upload files/URLs for analysis, perform any action on a scan, configure settings, and manage users.

With our Office 365 and G Suite apps, end-users can report on any suspicious email - both to your security team and to our Incident Response team, which will take the necessary measures.

After the incident response team takes care of the incident and determines the outcome, it is now possible to configure an option in which the end-user gets back an email letting them know if the email is clean, malicious, or a phishing simulation.

The email, just as similar emails to end-users, on quarantined emails contains information about the reported email including a screenshot of the email to make it easier for the end-user to get the right context.

The mechanism to insert disclaimers (i.e., banners) into inbound emails has been enhanced dramatically.

Now, you have complete freedom over all your disclaimers in one easy-to-use dashboard. You can preview, enable and disable them directly from the settings tab in your X-Ray account. 

You can customize how they will appear (the design) and who will see them at what time with our Complimentary Concierge Service.

Out of the box disclaimers (you can ask for additional disclaimers based on your needs) include:

• External. Displayed when an email is sent from someone outside the organization. 
• External - First Time. Displayed when an email is sent from someone outside the organization who is sending an email for the first time to the user.  
• Unscanned Password Protected. Displayed when an email includes a password-protected file that was only partially scanned.                                                           
• Display Name Deception. Displayed when an email is sent from a user impersonating someone in your organization.                                                          
• Spoofed Domain. Displayed when an email is sent from a domain impersonating another domain.                    
• Different Origin. Displayed when an email is sent from someone who is sending the email from a different path than his usual.    
• SPF Hard Fail. Displayed when an email is sent from IP that is not authorized for the domain it was sent from Disable.