Skip to main content

Riot in Trend Micro

❶ Introduction

Riot sends phishing simulation emails. Without proper configuration, some of these emails may be blocked or quarantined by Trend Micro, which can distort your campaign statistics.

The settings you need depend on two things: how Riot delivers emails to your mailboxes, and which Trend Micro product protects them.

This guide describes the steps to configure Trend Micro in order to allow necessary senders, URLs, and domains.

❷ Definition

Trend Micro is an integrated security solution (antispam, antivirus, web filtering) applied to emails and web traffic. It allows you to define sending policies, authorized senders, file scanning, and web reputation rules.
​

Trend Micro protects email with two products, which can run side by side:

  • Trend Micro Email Security (also called Cloud Email Gateway Protection): a gateway that filters emails before they reach your mailboxes.

  • Cloud Email and Collaboration Protection (in Trend Vision One, formerly Cloud App Security): connects to Microsoft 365 or Google Workspace and scans emails once they are in the mailboxes.

❸ Which settings apply to you

Check how Riot delivers your emails: it is the method you chose when you verified your domain in Riot (Microsoft API, Google API, or IP whitelist).

Riot delivery method

Trend Micro Email Security (gateway)

Cloud Email and Collaboration Protection

Microsoft API or Google API

Nothing to do. Riot places the emails directly in the mailboxes, so they never pass through the gateway. Sender and IP lists have no effect.

❹ Approve Riot's header

IP whitelist

❺ Allow Riot's sending IP

❹ Approve Riot's header

❹ Approve Riot's header (Cloud Email and Collaboration Protection)

Every simulation email Riot sends carries a header with your Riot workspace ID: X-Riot-Workspace-Id. Once you approve this header, Riot emails skip Trend Micro's threat protection and data loss prevention scans. Trend Micro designed this setting for phishing simulations. It does not approve any sender domain, so your real email traffic is still scanned.

Find your workspace ID

  • Send yourself an attack preview from Riot.

  • Open the email headers: in Outlook, File > Properties > Internet headers; in Gmail, Show original. You can also open a quarantined Riot email in the Trend Micro console.

  • Copy the value of X-Riot-Workspace-Id. It looks like 01234567-89ab-7cde-8f01-23456789abcd.

  • If you cannot find it, ask Riot support.

Add the header

  1. In Cloud Email and Collaboration Protection, go to Policies > Global Settings > User-Defined Lists > Approved/Blocked Lists.

  2. Click Exchange Online (Microsoft 365) or Gmail (Google Workspace), then go to the Approved Header Fields section.

  3. Turn on the approved header field list.

  4. Add these two entries. Name and Value are case-sensitive, so type them exactly:

    • Name X-Riot-Workspace-Id, Value: your workspace ID, match Equals

    • Name x-riot-workspace-id, Value: your workspace ID, match Equals

  5. Click Add after each entry, then OK.

If you have several Riot workspaces, add both entries for each workspace ID. Trend Micro accepts up to 50 entries.

Check the setting

Release the Riot emails already in quarantine, then send an attack preview from Riot and check that it reaches the inbox.

❺ Allow Riot's sending IP (Email Security, IP whitelist only)

Skip this section if Riot delivers your emails through the Microsoft API or the Google API.

  1. In the Trend Micro Email Security console, go to Administration > Service Integration > Phishing Simulation.

  2. In the Third-party phishing simulation section, add Riot's sending IP: 159.135.234.25. This IP is dedicated to Riot and is not shared with anyone else.

  3. Save.

❻ Associated Options/Functionalities (Cloud Email and Collaboration Protection policies)

If you approved Riot's header in ❹, Riot emails already skip these policies. Use the settings below as a baseline, or if you cannot use the header.

🔒 Advanced Spam Protection (Trend Micro)

  1. Go to the Advanced Threat Protection > Add tab

  2. Select the relevant policy (Exchange, OneDrive, etc.)

  3. In the left menu, click on Advanced Spam Protection

  4. Enable the option Enable Advanced Spam Protection

  5. Go to the Approved/Blocked Sender List section

  6. Enable Enable the approved sender list

  7. Add noreply.link and tryriot.com, then click Add

    • This covers only the simulations sent from these two domains. Your campaigns also use other sender domains, so the header in ❹ is the more reliable option.

  8. In the Rules configuration section:

    • Apply to: Incoming messages

    • Detection Level: Medium

🦠 Malware Scanning

  1. In the left menu, go to Malware Scanning

  2. In the Rules configuration section:

    • Apply to: All messages

  3. Enable the following options:

    • Scan all files

    • Scan message body

    • Enable IntelliTrap

  4. In Action configuration:

    • Choose Trend Micro recommended actions

    • Notification: Notify

📁 File Blocking

  • Enable File Blocking (recommended)

  • ⚠️ Do not disable this option: it applies to all messages, not only those from Riot.

🌐 Web Reputation & URL Approvals

  1. In the left menu: Web Reputation

  2. Enable Web Reputation

  3. In the Rules configuration section:

    • Apply to: All messages

    • Security Level: Medium

  4. In the Approved/Blocked URL List section:

    • Enable Enable the approved URL list

    • Enable Add internal domains to the approved URL list

  5. Add the domains generated by Riot (examples):

    domain1.com 
    domain2.com 
    domain3.com

    Then click Add >

💡Little Extra

Start with the header in ❹: it covers every Riot simulation, whatever the sender domain.

  • Use the exact attack domains provided by Riot for the approved list

  • Verify that noreply.link and tryriot.com are in the list of approved senders

  • Ensure that the policies are applied to Incoming messages with a detection level of Medium

Emails already in quarantine stay there after you change the settings: release them manually.

Did this answer your question?

Related Articles