What's New in Cloud Email Protection

December

2023

• Introducing New Technical Support Portal Fortra Support Portal (FSP). See Support
• Updated User Guide to reflect the Rebaranding of Agari Phishing Defense to Fortra Cloud Email Protection.
• A new dashboard page for unique visualization of the risk overview of your organization's inbound email traffic, see Cloud Email Protection Overview
• All new and updated Policy pages, see Create a Policy,Policy Settings,Create a Test Policy
• Updated On demand Policy page, see On-demand Policies, Create an On-Demand Policy
• Updated System Notification pages, see Add a Notification Recipient, Delete a System Notification Recipient
• Updated Enforcement page with Enforcement Policy setting details, see Enforcement
• Updated images to reflect the New Cloud Email Protection Icon, see Attack Classifications
• Updated CDR pages for CEP updates, see Continuous Detection and Response, Continuous Detection and Response Events, View Continuous Detection and Response Event Details

• Introducing New Technical Support Portal Fortra Support Portal (FSP). See Support

• On-Prem Sensor Updates:

• Documented general guidelines for on-prem sensor Installation / Upgrade. See Sensor Installation.

• Renamed Whitelists to Allow list in the User Guide. Removed all reference to Whitelist email/ Server configuration.
• Adjustments feature has been improved. Manual Adjustments can now be performed from Adjustments page for Email Address and URL adjustment types. See Adjustments.
• Minor edits and fixes.
• Image updates and minor edits in Configure Dual Delivery: G Suite.

• Minor edits and fixes.

• Updated User Guide for CDR changes. Removed details on APD app. See: Continuous Detection and ResponseContinuous Detection and Response Events, View Continuous Detection and Response Events, View Continuous Detection and Response Event Details, Change the State of a Continuous Detection and Response Event, Modify a Continuous Detection and Response Event Action

• Updated User Guide and API Documentation Guide as per Fortra ( the new face of Helpsystems ) re-branding guidelines.
• SenderBase Reputation Score (SBRS) service is now replaced with an IP Reputation service and scores are presented as IP Reputation.
• On-Perm Sensor updates:

• Updated Hardware and Software Requirements for sensor deployment. See, Sensor Prerequisites.

• CDR enforcement limit is 10,000 with Graph API. Updated Domain Specific Language Reference and Create On demand policy to indicate the same, see Domain Specific Language Reference, Create an On-Demand Policy.
• Enforcement status on Sensors page is not available when Graph Enforcement is Enabled. Updated Sensor pages to indicate the same, see Enforcement Sensor Status, View Sensor Status
• Rapid DMARC policy Trust score is now a 0-10 range, updated Rapid DMARC policy with new image and details. See Sender Management With Rapid DMARC.

• Updated Organization Setting, Documented Microsoft API Permissions tab, and the new Disable Ingest / Enforcement feature, see .
• Updated Configure Enforcement: Office 365. Office 365 will use only MS Graph API for enforcement, see Configure Enforcement: Office 365 using MS Graph API for Hosted Sensor

• Updated Domain Tags, to reflect new Domain Tags features (Domains with Traffic and All Domains with Tags), see Domain Tags.

• Fortra Cloud Email Protection Community Feed has been renamed to Community Intelligence Feed to support PhishLabs IOCs in CDR.
• This feature is now available for all CEP customers, so the field indicating Number of Participants has been removed.
• Updated images in Continuous Detection and Response.

• Minor edits and fixes.

• Updated all images to match the current application UI.

• Update Cisco CES/ESA BCC configuration to remove outdated "Tomki" screen shots. See Configure Dual Delivery: Cisco ESA
• Added a Note to explain partial and/or wildcard matching in search, real-time policies, and CDR. See Attachment and URL Analysis
• Updated the steps for whitelisting Alert Server. See Configure Dual Delivery: Office 365

• Updates to Block URL, to reflect new URL adjustment features, see Scoring Adjustments

• Added the new CDR Event Pending state, see Change the State of a Continuous Detection and Response Event
• Added MS Graph API support and features, see Configure Enforcement: Office 365 using MS Graph API for Hosted Sensor

• Updates to enforcement button behavior, see Create a Policy

• Minor updates and bug fixes

• Trust score tuning feature phase one added and documented, see Scoring Adjustments
• Added instructions to reboot the sensor after upgrading on Microsoft Exchange. See Configure Enforcement: Microsoft Exchange

• Updated the CDR Rule DSL syntax description to reflect a new restriction that returns an error when multiple uses of the same field-operator combination are joined with AND. See Domain Specific Language Reference
• Updated the list of URLs required for the sensor installation script. See Sensor Prerequisites

• Download of sensor diagnostic files is only available for on-premises sensors, not for hosted sensors. See note in Download Sensor Diagnostic Information
• Added Permanent Error to list of possible message SPF results in Continuous Detection and Response Rules.
• Added a note recommending increasing Microsoft Exchange maximum message size on Agari send connector to 100MB. See Configure Dual Delivery: Microsoft Exchange.

• Significant changes to the search language that you can use to create continuous detection and response (CDR) rules have been made. See Domain Specific Language Reference for details.
• The ability to create custom, local continuous detection and response (CDR) rules has been added. See Continuous Detection and Response Rules.

• (CDR) rules added. See Continuous Detection and Response Rules.

• Message details now provide additional insight into how a message score and attack classification was determined. Attack Classifications shows details for the different attack types.

• Processing exceptions can now be defined so messages will not be evaluated. See for details.
• Message details now have a CDR (see Continuous Detection and Response) link. See View Message Details for more information.

• Fortra Cloud Email Protection is the new name for Advanced Threat Protection. You will see the new naming and an updated logo throughout the product.
• The Continuous Detection and Response (CDR) feature has been improved. CDR now also takes threat intelligence from the Agari Business Email Compromise (BEC) feed, sourced by the Agari Cyber Intelligence Division (ACID), to search for indicators of compromise (IOCs) in employee inboxes.
• Clarified that on-demand policies created from search results can only apply to inbound messages. This is relevant when insider impersonation is enabled and inbound, outbound, and internal messages are being ingested by the Sensor. See Create an On-Demand Policy for details.

• Clarified mail routing configuration for G Suite. See Configure Dual Delivery: G Suite.
• Added section on Skipped Addresses for Azure Active Directory address group syncronization. See Microsoft Entra ID (formerly Azure AD) Synchronization With Address Groups.
• Added information about the Allowed Forwarding IPs setting in the Sensor Settings section of organization settings. See .

• Updated the Sensor requirements. On-premises Sensors now require Python 2.7 or newer.

• The guide used "global administrator" in a couple of places that were causing confusion, leading users to believe that the role was required for Cloud Email Protection to access their systems. In reality, certain access permissions are required just to configure those systems to allow access by Cloud Email Protection. The content was changed in those places to more accurately reflect this.
• Clarified when the View AIR Investigation link is visible in Continuous Detection and Response events. See View Continuous Detection and Response Event Details.
• Google changed its terminology, no longer referring to "Google Developers Console." The topic for configuring enforcement in G Suite was updated to reflect Google's new nomenclature.
• Clarified that Fortra employees cannot make changes to Cloud Email Protection user accounts. See User Accounts.
• Plain text search fields in Cloud Email Protection are now limited to 100 characters.

IIP requires Microsoft 365 or Exchange as your email provider and you must:

• Explicitly enable this feature in your organization settings. See for more information.
• Insure the proper directionality headers are added to all messages. See Configure Dual Delivery: Office 365 and Configure Dual Delivery: Microsoft Exchange for more information.

Message directionality is also available in search and policy criteria. See Message Search and Policy Settings for more information.

• In message searches and policy settings, for parameters that are numeric and have upper and lower bounds, the upper and lower bound values are now inclusive.

• The attack vs. peer enforcement graph has been enhanced to clarify its values. See How Attacked/Protected Am I Relative To My Peers Report.
• Information about how to prepare for using Cloud Email Protection (see Before You Begin) and how to access the Cloud Email Protection API documentation (see Application Programming Interface) has been added to this guide.
• Additional detail about default policies has been added to this guide. See Default Policies.

• Cloud Email Protection no longer officially supports Sensors in an inline architecture, so that information has been removed from this guide.
• Reference content for message search has been added. See Message Search for details.
• Message search results can now be downloaded. See Download Message Search Results for details.

Most of the changes in this version of the guide are correction, clarifications, updates because other systems changed, and bug fixes.

• Cloud Email Protection's Continuous Detection and Response (CDR) is now available. CDR is an Fortra Secure Email Cloud technology that allows organizations to prevent or mitigate data breaches as new threat intelligence is discovered. CDR is available to Cloud Email Protection customers who also have a subscription to Fortra Phishing Response. Contact support to understand the requirements for obtaining CDR. See Continuous Detection and Response for details.
• Fortra's Secure Email Cloud (SEC) also includes a mobile application that allows you to monitor and take actions on continuous detection and response (CDR) events. See Fortra App for details.
• The guide clarifies who can change report values. See Configure the Money Saved By Deploying Cloud Email Protection Report for details.
• Additional information about how the internal and partner tags are used and best practices for applying them to domains was added to the Domain Tags topic. See Domain Tags for details.

• You can now set custom date ranges for the Threat Trends and Executive Summary reports.
• Clarifications were added for Sensor port requirements and for supported Sensor architecture.
• Additional organization settings are available for how an organization is classified. These classifications, including region, industry, and organization size, are used for one of the executive summary reports. See Money Saved by Deploying Cloud Email Protection Report.

• Reporting improvements

A new set of reports are available in Threat Trends and Executive Summary tabs on the home page, reports that provide at-a-glance views of the benefits of using Cloud Email Protection. These reports show a daily updated view of the value that Cloud Email Protection provides, and you can download a snapshot of either page as an Adobe Acrobat (PDF) file. Additional organization settings allow customization of the message data in the reports. Find out more in Threat Trends Reports and Executive Summary Reports.

• Message feedback improvements

Cloud Email Protection now allows you to provide more details when sending feedback about an individual message. See Send Scoring Feedback for details.