Automation for blocking user-reported spam emails

Products

• Email Security.cloud

Issue/Introduction

You want to automatically block emails or senders reported by users to help prevent future spam.

Environment

Email Security.cloud

Resolution

While there isn't a direct native automation that syncs user reports from the Microsoft 365 portal or a mailserver directly into the Email Security.cloud Blocked Senders list, we offer several tools and features that can help achieve your goal of streamlining this process.

To improve your anti-spam posture and provide users with a way to report/block emails, we recommend the following options:

Symantec Email Submission Add-in: You can install this add-in directly into your O365 environment. This allows users to report missed spam with one click. These submissions go directly to our Security Response team to improve global filtering and can be monitored by your team.
Email Submission add-in 101 for Email Security.cloud

User Control for Blocked Senders: You can enable a feature that allows users to manage their own "Approved" and "Blocked" senders lists via their Quarantine notifications. This empowers users to block specific senders without administrator intervention.

Indicators of Compromise (IOC) Blocklist: Email Threat Detection and Response customers can access the Indicators of Compromise (IOC) Settings screen in the portal at Dashboard> Services> Email Threat Detection and Response> IOC Blocklist Settings.
How to configure Indicators of Compromise (IOC) Blocklist Settings for Email Security

Best Practice is to ensure that Skeptic Heuristics and the Signaturing System are set to "Quarantine" or "Block and Delete." These systems automatically learn from global spam trends and user reports to block similar future emails.

Manual options to submit false positive and false negative detections are still available in the portal.