Barracuda Impersonation Protection Updates

Impersonation Protection Classifier Enhancements

2023-09-27T16:08:17.852Z

Increased Impersonation Protection efficacy by improving detections and reducing false positives. Enhancements have been made in the following areas:

QR code-based attacks
Scam related campaigns
Business email compromise

Admin users will see these detections on the Impersonation Protection UI. We encourage all users to submit missed emails and incorrect detections via the Barracuda Email Protection Add-In.

Highlighting Keywords, Statistics and More

2023-04-20T21:40:23.248Z

In the analysis panel for a message, in addition to Severity, Confidence, Determination and Key Indicators, we now have Highlighting of Keywords in the body, Headers and Statistics.

To Enable Highlighting:
From within a message, toggle to enable Highlighting at top-right to see the elements of a message that Barracuda Impersonation Protection deem as suspicious. Keywords and phrases in the message content will have red boxes around them. Other identifiers, shown via the Sender Information chips and Header information will display in red. The Email and Header tabs will show red dots if they display suspicious information.

Learn more on campus

False Positive percentage in overview section

2022-11-01T22:28:06.744Z

You can now see the FP% along with the total emails processed, and total threats detected in the overview section of Impersonation Protection.

False positives is the percentage of messages marked as threats that were actually good emails. An asterisks here means the percentage is less than 0.001%. You can hover over this number to see the actual percentage.

Campus: https://campus.barracuda.com/product/sentinel/article/preview/98212871

Enhancements and UI updates

2022-07-28T15:28:35.828Z

Classifier Enhancements:

Over the last couple of months, we have worked to improve our efficacy by improving detections and reducing false positives. Here are a few examples:

Introduced a new classifier that identifies emails containing bad URLs from services utilizing IPFS links, which increased phishing detections.
HTML has now replaced PDF as the most weaponized artifact. We have added improvements to HTML attachment classifier as well as HTML classifier to further improve phishing detections.
ATO classifier enhancements to include impossible travel and other features to improve ATO detections and reduce false positives.
While most of our classifiers are language independent, there are some classifiers that perform better when trained in different languages. Our CEO Fraud classifier is one such classifier which has been enhanced through native Spanish, German, Italian, French, Portuguese, and Dutch support. In addition, Simple CEO classifier and BAIT (reconnaissance) classifiers have also been added to improve BEC detections.
A new classifier has been added to detect fake invoices which are embedded in emails.
Phish masking is a common technique used by attackers to hide malicious URLs behind link forwarding or shortening services. Many attackers use multiple forwarders (bit.ly, goo.gl or tiny URL for example) to evade detection. For example, a phishing_link.com maybe wrapped x number of times before the malicious link is finally opened. Attackers are also known to utilize well known services like Salesforce and SendGrid (just to name a couple) to mask their URLs. Ability to dynamically resolve and expand URLs has been greatly enhanced.

UI Enhancements:

In addition to the improvements to our classifiers we are pleased to announce that our migration efforts to the new, more engaging technology is now complete. This allows us to quickly build and iterate on new features that you have asked for. One such feature is the addition of the “Statistics Tab”. To help you better understand why an email was blocked, we now have Sender Analysis and Sender Authentication details in addition to Confidence & Severity level, and Key Indicators when you click on more details to review an alert.

Your UI has a new look!

2021-12-06T17:26:08.790Z

We are currently in Beta. To get added to our beta program, please send us an email at emailproductfeedback@barracuda.com.

As part of our efforts to faster development and moving to newer technology, your UI now has a new look when you log into Impersonation Protection. Here is the new look:

Benefits to you

Our users are always at the heart of our innovations and this release gives us greater flexibility and increased speed in integrating the new features you have been requesting
You now have visibility into the confidence score each email gets when processed via Impersonation Protection
You can also see the severity of a threat against each email
You have the ability to set up different email addresses for ATO alerts vs Phishing alerts.

NEW! Email Protection SaaS Plans

2021-12-06T16:23:08.126Z

They’re here! We are excited to announce the general availability of our new email protection plans. As part of our mission to provide innovative security products that are easy to buy, deploy, and use, our new plans are designed to better align with customer’s Office 365 security needs and buying preferences. As an existing customer there will be no changes to your products or plans. However, some features have new, more descriptive names and have undergone small changes. For more information on the new plans please visit https://campus.barracuda.com/doc/96014231/

Schedule Sentinel Report

2021-07-07T21:35:24.156Z

Barracuda Sentinel automatically emails reports to you or your team on a regular basis, so you can keep up with recent activity. By default, Barracuda Sentinel emails monthly reports to the security team email specified on the Remediation tab in the Settings.

To schedule email reports:

Open Barracuda Sentinel.
Click the Settings icon to access the administrative functions.
Select the Reports tab.
By default, Send reports by email is set to On (blue).
Select the time range for the data you want to see in the reports. Options are Last 7 Days, Last 30 Days, or Last 90 Days. The default value is Last 30 Days.
Specify the report recipient. By default, emails are sent to the security team email specified on the Remediation tab.
To specify a different recipient, switch the toggle to Off (grey) and type one email address in the Send to field that appears.
In the Start date field, type or select the date you want to start receiving automated emails.
In the Frequency field, specify how often you want to receive reports. Options are Daily, Weekly, and Monthly. The default value is Monthly.
Click Save.

Discontinuing Email Reports

If you do not want to receive these automated emails, you can stop them by changing the settings to toggle off for Send reports by email

In the future we plan to support other formats. However, for now an email will be sent with the data requested.

Feedback on Reported Messages

2021-04-23T19:45:26.397Z

We heard your feedback. When you report a message as False Positive in Barracuda Sentinel, in addition to the submission confirmation, as the first step, you will also be asked to provide additional details as to why you think that message was false positive. In the future, we will provide the steps we took based on this additional information.
If you choose to provide these details, you will be redirected to a feedback response form to select a reason from a list of options or to type in a reason.

You can also click on the link "Report this is not phishing" from within the alert email you receive for an attack. This will follow the same workflow once you click on the link, where the form for additional feedback is presented.

You can also find this information on campus here: https://campus.barracuda.com/product/sentinel/doc/80740499/false-positives/

Changed "Quarantined" to "Moved to Junk folder"

2020-03-23T18:42:00.001Z

The action to move a malicious email to a user’s Junk folder was previously labeled as "Quarantined". This was confusing to many customers because the Barracuda Email Security Service also uses the same term. This action is now referred to as “Moved to Junk folder” to reduce confusion. There is no change in behavior.

New usage report

2020-03-20T18:20:00.001Z

We just released a report showing which Office 365 mailboxes are licensed and monitored.

You can view the report by going to the dashboard page on Barracuda Sentinel. It displays a list of all the mailboxes (users and shared mailboxes) and whether they have an Exchange license entitelment or not, and whether it is being monitored and protected by Barracuda Sentinel or not.

It is possible that a mailbox does not have an Exchange license, but Barracuda Sentinel will still monitor and protect it. There is also the case where a mailbox is licensed but we are unable to monitor it. Those are rare.

We think the report will go a long way in helping you understand which mailboxes are being protected by Barracuda Sentinel.

Learn more about it at https://campus.barracuda.com/product/sentinel/doc/91984521/understanding-the-dashboard/