• Cloud App Security
• Understanding Cloud App Security
  • Understanding Email Security
    • Understanding Post-Delivery Email Recheck
  • Using Data Leak Protection
  • Understanding Anomalies
  • Understanding Click-Time Protection
• Configuring Cloud App Security
  • Subscribing to Cloud App Security
  • Activating Cloud Applications for Cloud App Security
  • Activating G Suite Cloud Applications
    • Using Cloud App Security with Google Cloud Directory Sync
• Managing Quarantine for G Suite
  • Setting Up a Quarantine Mailbox for Gmail
  • Setting Up a Quarantine Folder for Google Drive
  • Using the Quarantine View for Gmail
  • Using the Quarantine Page
  • Using the Quarantined File Creator Dashboard
  • Using the User Dashboard for G Suite
  • Managing Restore Requests
• Using the SonicWall Cloud App Security Dashboard
  • Using the Security Events Widgets
    • Changing a Security Event Widget to an Alert or Custom Query
    • Resetting a Security Event Widget
    • Hiding a Security Event Widget
    • Configuring Security Event Widget Custom Queries
    • Adjusting the Time Scale
  • Viewing the Summary of Security Events
  • Viewing Login Events
  • Viewing Secured Applications
  • Viewing the Scanned Files Summary
• Managing Security Events
  • Using the Security Event Graphs
    • Viewing Security Events by Severity
    • Viewing Security Events by State
    • Viewing Security Events by Cloud Application
  • Viewing and Acting on Security Events
    • Removing Filters
    • Acting on Security Events
  • Managing Multiple Events
• Managing Policies
  • Understanding Cloud App Security Policies
    • Before You Set Email Policies
    • Monitor only
    • Detect and Prevent
    • Protect (Inline)
  • Creating New Policy Rules
    • Creating Data Leak Protection Policy Rules
      • Using Regular Expressions in DLP Policies for Email
    • Creating Malware Policy Rules
    • Creating Threat Detection Policy Rules
    • Creating Policy Rules for Click-Time Protection
    • Creating Custom Query Policies
  • Stopping Policy Rules
  • Removing Policy Rules
• • Configuring Data Leak Protection Detection Rules
  • Reactivating Data Leak Protection
  • Predefined Data Leak Protection Policy Rules
    • Global Rules
    • Credentials and Secrets
    • Predefined Data Leak Protection Rules for Specific Countries
      • Argentina
      • Australia
      • Belgium
      • Brazil
      • Canada
      • Chile
      • China
      • Columbia
      • Denmark
      • Finland
      • France
      • Germany
      • Hong Kong
      • India
      • Indonesia
      • Ireland
      • Israel
      • Italy
      • Japan
      • Korea
      • Mexico
      • The Netherlands
      • Norway
      • Paraguay
      • Peru
      • Poland
      • Portugal
      • Singapore
      • Spain
      • Sweden
      • Taiwan
      • Thailand
      • Turkey
      • United Kingdom
      • United States
      • Uruguay
      • Venezuela
• Managing Spam and Anti-Phishing
  • Managing Spam
  • Customizing Warning Messages
  • Managing Nickname Impersonation
  • Managing the Anti-Phishing Exceptions
    • Managing Excluded Email Addresses
      • Adding Email Addresses to the Anti-Phishing Block-List
      • Removing Email Addresses from the Anti-Phishing Block-List
    • Managing Excluded IP Addresses
      • Adding IP Addresses to the Anti-Phishing Block-List
      • Removing IP Addresses from the Anti-Phishing Block-List
    • Managing Excluded Domains
      • Adding Domains to the Anti-Phishing Block-List
      • Removing Domains from the Anti-Phishing Block-List
    • Creating Block-List Rules from Email Messages
    • Managing the Anti-Phishing Allow-List
      • Creating Anti-Phishing Allow-List Rules from the Security Events Page
      • Creating Anti-Phishing Allow-List Rules from the Anti-Phishing Allow-List Page
    • Managing the Anti-Phishing Block-List
• Configuring and Using Click-Time Protection
  • Activating Click-Time Protection
  • Configuring Click-Time Protection
    • Configuring the Click-Time Protection Workflow
    • Configuring Custom Click-Time Protection for Specific Domains
      • Adding Custom Click-Time Protection for Specific Domains
      • Deleting Custom Click-Time Protection for Specific Domains
  • Using Click-Time Protection
    • Viewing Security Events for Click-Time Protection
    • Managing Email Messages with Click-Time Protection
    • Creating Custom Queries for Click-Time Protection
• Using Cloud App Security Analytics
  • Viewing the Summary Report
  • Viewing the Weekly Reports
  • Viewing Email Analytics
  • Viewing Google Drive Analytics
  • Viewing Shadow SaaS Analytics
  • Viewing and Creating Custom Queries
    • Creating Custom Queries
    • Adding Custom Queries to the Dashboard
• Configuring Cloud Applications in the Cloud App Store
  • Configuring G Suite for Cloud App Security
  • Re-Authorizing Cloud Applications
• Managing Security Applications in the Security App Store
  • Starting Security Applications
  • Stopping Security Applications
• Managing Anomaly Exceptions
  • Creating Exceptions Based on Anomaly Events
  • Sending Anomaly Event Notifications
• Managing Security Tool Exceptions
• Using the System Log
  • Viewing the System Log
  • Exporting the System Log
• Managing Cloud App Security Licenses
  • Adding Administrator Users
  • Adding Read-Only Users
  • Managing Group Licensing
  • Unassigning Cloud App Security Licenses
• SonicWall Support
  • About This Document

Creating Threat Detection Policy Rules

To create a Threat Detection policy rule

1. In the Rule Name field, enter the name you want to use to identify the rule.
2. From the Mode dropdown list, select the mode in which you want the DLP policy rule to operate:
   • Monitor only
   • Detect and Prevent
   • Protect (Inline)
3. In the Scope section, either:
   • Select All users and groups (all licensed users) to have the policy rule either apply to all users.
   • In the Specific users and groups list, select the specific users or user groups to which the policy should apply or be excluded from being applied.
4. In the Advanced section, the workflow options you see will depend on the Mode set for the policy.
   • For the Malicious attachment workflow, you can specify that:
     • messages or files be quarantined, and the recipient is alerted and allowed to restore the email messages or files.
     • messages or files be quarantined, and the recipient is alerted and allowed to request that the email or files be restored by an administrator.
     • messages or files be quarantined, but the recipient is not alerted. However, an administrator can restore the message.
     • no action be taken on the message. The event will still be logged.
   • For the Phishing workflow, you can specify that:
     • messages or files be sent to the intended recipient with a warning.
     • messages or files be quarantined, and the recipient is alerted and allowed to restore the messages or files.
     • messages or files be quarantined, and the recipient is alerted and allowed to request that the messages or files be restored by an administrator.
     • messages or files be quarantined, but the recipient is not alerted. However, an administrator can restore the messages or files.
     • no action be taken on the messages or files. The event will still be logged.
   • For the Suspicious phishing workflow, you can specify that:

     • messages or files be sent to the intended recipient with a warning.

       The content and formatting of the warning can be customized by clicking the gear icon to the right of the list.

     • messages or files be quarantined, and the recipient is alerted and allowed to request that the messages or files be restored by an administrator.
     • messages or files be quarantined, but the recipient is not alerted. However, an administrator can restore the message.
     • no action be taken on the messages or files. The event will still be logged.
   • For the Spam workflow, you can specify that:
     • email messages be sent to the intended recipient with “[Spam]” added to the Subject line.
     • email messages be sent to the intended recipient with “[Spam]” added to the Subject line and delivered to the Spamfolder.
     • email messages be quarantined, the recipient is alerted, and the recipient can restore the email message.
     • email messages be quarantined, but the recipient is not alerted. However, an administrator can restore the email message.
     • no action be taken on the email message. The event will still be logged.
   • From the Severity list, specify severity level with which the event will be recorded:
     • Auto
     • Critical
     • High
     • Medium
     • Low
     • Lowest
5. In the Advanced > Security Tools section:
   1. Select All running threat detection tools to use all of the activated Security Tools. (This is on by default.) If you unselect this option, you can then select which specific Security Tools are used.
   2. Click Configure Anti-Impersonation and Phishing Confidence-Level to configure additional anti-phishing options.
      • Select a value for the Confidence level field to set a default confidence level. By setting a higher confidence level, you should see fewer detections and fewer false-positive results.
      • Enable Warn users of suspected impersonations to warn users of suspected impersonated messages and accounts. You can set the detection level to all internal users or only senior-level users within your organization.
      • Select Allow end users to Allowed list senders they trust via in-mail link to allow your end users to add senders they trust to the Allowed list using a link provided in the email message.
      • Select Allow list emails with MSFT SCL = -1 to automatically allow emails that Microsoft marks as allowed by placing SCL=-1 in the header of the email message.

      For more information about configuring the anti-impersonation options, refer to Managing Nickname Impersonation.

   3. Click Ok.
6. In the Advanced > Alerts section:
   1. Select Send email alert to admin(s) about phishing to notify administrators when a possible leak is detected.
      • Click the gears icon to modify the email message sent to administrators.
      • Click the users icon to select which administrators should receive the message.
   2. Select Send Email alert to… to notify specific users sharing the file when a possible threat is detected.
      • Click the gears icon to modify the email message sent to the users.
   3. Select Send email alert to admin(s) about malware to notify administrators when a possible threat is detected.
      • Click the gears icon to modify the email message sent to administrators.
      • Click the users icon to select which administrators should receive the message.
   4. Select Alert recipient to inform the recipient of the message when a possible threat is detected.
      • Click the gears icon to modify the email message sent to the recipient.
7. Click Save and Apply.