Targeted Threat Protection: Impersonation Protect

Document created by user.oxriBaJeN4 Employee on Apr 11, 2016Last modified by user.oxriBaJeN4 Employee on Oct 9, 2017
Version 10Show Document
  • View in full screen mode
Targeted Threat Protection - Impersonation Protect is part of our Targeted Threat Protection suite. You must have another product from this suite (e.g. Targeted Threat Protection - Attachment Protect or Targeted Threat Protection - URL Protect) to use the Targeted Threat Protection - Impersonation Protect product.

The increasing number of "whaling" attacks, usually targeting an organization's senior management, means additional protection is required against email threats that do not contain attachments or URLs. Traditional spam filtering systems are unable to detect these as suspicious, due to their minimal content. Targeted Threat Protection - Impersonation Protect solves this, by:

  • Looking for combinations of key identifiers commonly found in these attacks.
  • Tagging a message to make it clear that it is coming from outside your organization.




In the impersonation protection definition, you can specify the number of identifiers that must be triggered before any action is taken. The available identifiers are:

  • Similar Internal Domain
  • Newly Observed Domain
  • Internal User Name
  • Reply to Address Mismatch
  • Targeted Threat Dictionary


Based on whether the required number of identifiers is triggered, you can specify the action to take if an email is identified as suspicious. The action can be:

  • Bounce
  • Hold
  • Tag


External Messages


Additionally, you can help users identify all messages as coming from an external domain regardless of whether any identifiers are triggered. This takes the form of text that can be added to a message's:

  • Body
  • Subject
  • Header


See Also...


2 people found this helpful