1️⃣ Objectives
Threat analysis allows you to:
streamline the processing of suspicious emails sent by employees
automatically send a follow-up notification after the user labels the reported email (marked as safe, spam, or fraudulent)
centralize all your fraudulent emails in one place
2️⃣ Two reporting methods: Alias vs Phishing Reporter
👉 Option 1: I use the Riot exotic address or the alias
You can find the exotic address in the settings of the “Inbox” module.
The alias, on the other hand, allows you to highlight a more easily understandable address for your employees.
👉 Option 2: I use the Riot “Phishing Reporter” add-in
The phishing reporter button allows your employees to report a phishing email with a single click on the button available in their mailbox.
3️⃣ Processing by AI
👉 Optimize processing with the “Threat Analysis” option
If you enable the AI automatic labeling option, emails in your inbox will be automatically labeled, meaning no human action is required.
If email labeling via our AI fails, you will receive a notification, and the email will remain in “Unsorted” status. This way, you can manually label it correctly.
When the box “Only pre-label emails with AI” is checked, the AI pre-labels the email and you can validate or modify the labeling if it is inaccurate.
👉 How are emails analyzed by AI?
The AI relies on the following elements to analyze and label an email as safe, spam, or fraudulent:
Phishing signs: Looking for indicators such as spelling errors, requests for personal information, or urgent calls to action.
Technical analysis: Examining technical elements (sender, recipient, subject, content, DKIM, DMARC, SPF, SCL) to detect suspicious activity.
Sender’s IP address: Verifying the sender’s IP against a list of known malicious IPs; a match likely indicates fraud.
Sender’s domain: Comparing the sender’s email domain against a list of fraudulent domains and addresses; a match suggests fraud.
Suspicious activity: Investigating anomalies such as spoofed sender addresses or reply-to addresses different from the sender’s.
Email headers: Comparing headers with those of known fraudulent emails; a match is a strong indicator of fraud.
Threat intelligence platform: Using intelligence sources to check for malicious IPs linked to the sender.
Email body: Analyzing content for fraud indicators such as suspicious wording, urgent requests, or questionable links, to determine if the email is fraudulent, safe, or spam.
Links in the email: Reviewing included links, verifying their security certificate, and analyzing their content to decide if the email is fraudulent, safe, or spam.
👍 Good to know: We recommend checking the box “Only pre-label emails with AI” at first to allow the AI to train and improve in suggesting the correct labeling level (safe, spam, fraudulent).
After a few months of using the module, you can go back to the settings and uncheck this box if necessary!