Hello, and thank you for your interest in PhishER. This is KnowBe4's platform for
working with messages reported by end-users, as they become trained and more
familiar with spotting threats in their inbox. This is a fully hosted platform,
so everything you see here is in the cloud, and what you're looking at right now is
the dashboard. This is a quick overview of messages that have come in over time,
what those messages have been dispositioned as (clean, spam, threat)
and the priority that these messages have been given. Anything from low to critical.
You'll also see how many of these
messages have been automatically resolved, and this is really your big time-saver,
and that's the whole purpose of this platform, we want to save you time,
and we want to make it easier for you to identify and disposition messages
as they come in, and we're gonna do that by jumping straight into the Inbox.
It's an inbox -- everybody's seen it, but we bring you a little bit more information.
We've got a Tags column here, and these tags are there to tell you a little bit
about the message before you even start drilling in. We have a message here for example,
has the "PML_THREAT" tag. This tells me that PhishML
(our machine learning module) has decided that this message is a threat.
We have "VT_BAD", that tells me VirusTotal has found something that it doesn't like in there,
and a custom tag called "INVOICE", and that tells me that somewhere
in this message it says the word "invoice". Think it's right there in the subject.
...And now that we're in the message, we can very quickly see what the message is,
jump right over into the raw parts of the message, check the header for
standard or non-standard headers. If we've got something in particular we're
looking for, we can check it right there. Any attachments will be automatically scanned
if you bring your own key. And we know that this one's already bad.
Good job, not paying this invoice! Any URLs will also be automatically scanned,
and if they've been shortened by any way, you can also unwind them here automatically.
The Match rules will show here, and that's that custom rule that we talked about,
and we can see a full audit log of everything that's happened to this message.
So anyone in your SOC, your InfoSec team, can come in here and
quickly analyze that message and disposition it, it's Threat it's
Resolved, it's High-Priority. But then, to take it one step farther we
can also initiate a PhishRIP query to find similar messages, by whatever
criteria you've set. In this case, let's, say, find everything from this gentleman
that has the word, "new invoice" and find it within the last few days,
and automatically quarantine everything. This is going to go through your entire O365
organization, and automatically quarantine any messages that fit this
criteria throughout your entire organization.
Now that this one's done,
we can go on to the next one, and we can do the same thing and manually disposition
each one -- but that's one at a time. How do we really save time? Well if we come over
here to Rooms, we can get a quick grouping by Subject, Sender, URL,
Attachment, Names or any other saved query that we like. And we saw that new
invoice right there. It turns out that we were looking at only one of six. So since
we've already done our research, we can come in here and just both disposition all of these.
But if we look we see that we've gotten this message six times in the past week.
Odds are this guy's going to send us those messages again, as time goes on.
How do we protect ourselves for the future, and not just look in the past?
Well, we can build rules. That invoice rule that we were looking at --
simply looks for the word, "invoice" in it, but it brings us that little bit of information
right at the beginning. It's also got rules that check to see if someone is posing
as our CEO. You can do all sorts of things with YARA, and what that will do
is add tags to those messages, so we see them on the inbox, and that gives us that
little bit more information, before we get into the message. But where it really
gets good, is right over here in Actions. From those tags we can come in,
and say, "All right, if we see that CEO fraud tag, automatically disposition this message."
Set it to "In Review," set it to "Priority High," set it to a category of "Threat,"
and automatically dump this out to our syslog, to our SIEM through
If it was a spam, maybe I send a message back to the original reporter,
and say, "Hey please stop sending spam. For your information, this is
what we want you to use the Phish Alert Button for.." or maybe if it's a threat,
I'm also going to send it out to my InfoSec team, attach an original of the message
and maybe include links back to PhishER.
The Rules and the Actions are really your one-two combo to REALLY save time.
But as time goes on, you'll also get some
really good information from their reports, find out which of your users are
using that Phish Alert Button to just get rid of their spam, or maybe they're
sending a whole lot of threats, and you can build more rules to automatically
prioritize those messages higher or lower.
So as a quick overview, see what messages are coming in.
Automatically start getting that information from the inbox.
Get some quick information from PhishML, get some quick information from VirusTotal.
Once you've found those threats, automatically rip them out of inboxes
over your entire organization with PhishRIP, and automate away a lot of your work.
Give yourself time to focus on those threats.
And that's it for this brief intro.
If you'd like to know more, please schedule some time for your own
one-on-one demo, where a sales rep can take you through the entire PhishER platform
at more depth. Thanks, have a good day.