Which headers does ESS IOC blocklist add?

Products

• Email Security.cloud

Issue/Introduction

When using IOC blocklist with action tag header, which header get added to the email?

Environment

Email Security.cloud

Resolution

When the IOC blocklist service triggers against an IOC that's been set up with the action of "tag header", the following tags will be added:

X-IocDescription:
X-IocId:
X-IocReason:

 

The first header will show the description that was given to the IOC when it was uploaded
X-IocDescription: The IOC description

The second header will show the unique IOC ID given to the IOC at the moment of upload
X-IocId: matched (fecf5605-09ba-4cab-8e61-a30142feb80e)

The third header will show the IOC value that caused the trigger
X-IocReason: naughty subject