Chapter 2 - Setup

Admin users with any user role are able to display the Profile page.

Personal Information

Full Name

Shows your full name in Perception Point X-Ray. This name will be displayed on the right of the Perception Point X-Ray banner, and will be used in various other locations by Perception Point X-Ray.

Only a user with the "Administrator" role can change the name of a user.

Email Address

Shows your email address. All relevant Perception Point X-Ray communication with you'll be sent to this address.

Only a user with the "Administrator" role can change your email address.

Security

Force Multi-Factor Authentication

Forces all users in the organization to enable and set-up multi-factor authentication [MFA - see below] to access Perception Point X-Ray.

This option appears only for users with the "Administrator" role.

User MFA

Lets you activate and set-up multi-factor authentication [MFA] that will be required for you to access Perception Point X-Ray.

After you activate MFA:

When you next log-in to Perception Point X-Ray, you'll be instructed to scan a QR code with Google Authenticator [or a similar authenticator app], and then enter a passcode.

You'll also get a recovery code that you can use to access Perception Point X-Ray when your device is not available. Make sure to keep the recovery code in a safe place. The recovery code may also be required in the case of an account take-over.

If necessary, contact Perception Point Support [support@perception-point.io] for help to reset your MFA.

To transfer MFA from one device to another, remove the admin user, and then re-add the admin user. Thereafter, you can activate MFA on the new device.

To disable MFA, contact Perception Point Support [support@perception-point.io].

Password

Changing or resetting your password

Click "Reset Password" to reset your password. An email will be sent to your registered email address [see above]. The email will contain instructions on how to reset your password.

You can also click "Don’t remember your password?" on the Perception Point X-Ray log-in page.

There is no expiration period for passwords.

API Key

You may need this value for authorization when using Perception Point X-Ray API calls. For details about the Perception Point X-Ray API, see API.

For security reasons, the API key is blurred in the UI. Click the Copy button [

] to copy the API key to the clipboard.

Contact Information

Organization Name

The name of your organization - as it will appear throughout Perception Point X-Ray.

The organization name can be changed by Perception Point Support [support@perception-point.io] only.

Organization's Default Interface Language

The language of the Perception Point X-Ray user interface that will be displayed to new admin users in your organization.

Admin users can change the UI language that is displayed when they sign-in to Perception Point X-Ray.

To change the Perception Point X-Ray interface display language:

[Old method] Click the Language icon on the right of the Perception Point X-Ray banner, and select the required language.

[New method] Click the down-arrow that is on the right of your name on the right of the Perception Point X-Ray banner, click Language, and then and then click the required language.

The currently available interface languages are English, Spanish, German, French, Italian, Portuguese, Korean, and Japanese.

The default display language can be changed by Perception Point Support [support@perception-point.io] only.

The Admin Users page is available to admin users with the "Admin" role only.

Role functionality

Explanation

Upload files

Can upload files to be analyzed. For details, see Self Analysis.

View scans

Can view scans.

Preview and download

Can preview and download scan details.

Scan actions

Can perform various actions on scans.

Settings

Can configure settings.

Manage users

Can configure admin users. See "About Perception Point X-Ray admin users" on page 7 above.

Note: Only an admin user with the "Admin" role can change the role of an admin user. For all other user roles, the Edit [

] button [see below] will not appear.

Note:

Only an admin user with the "Admin" role can invite a new admin user. For all other user roles, the Add User button [see below] will not appear.

You can't add an admin user to an organization that is Inactive.

If your organization is configured to force users to sign-in to Perception Point X-Ray using SAML, then it is not possible to add [invite] new admin-users using the procedure that is described on this page. [The Add User button (see below) will not appear.] Instead, the admin-user needs to sign-in to Perception Point X-Ray using the "Log in with SSO" option, or via the SAML app. The first time a new admin-user successfully signs-in to Perception Point X-Ray, a corresponding new admin-user will be created in Perception Point X-Ray. For further details, see Forcing SAML sign-in.

Each admin user is identified by an email address. An email address can be assigned to only one organization. Therefore, an admin user can't be added to more than one organization - unless a different email address is used for each organization.

Dialog box options

Email address

Specify the email address of the new admin user. An invitation email will be sent to this email address.

Role

Select a role for the new admin user. The role defines the user's access permissions within Perception Point X-Ray.

View verdict permissions

Some roles permit admin users to access scans in the Scans page. By default, when an admin user is permitted to access scans, the admin user is able to access scans that have any verdict. "View verdict permissions" lets you specify that the user will be permitted to access scans that have specified verdicts only.

Organization

Select the Organization that the new admin user will be able to access. See "Admin user access" on page 12 below for additional information.

Note

The "Join Now" link in the invitation email expires 72 hours after the email is sent.

If the "Join Now" link expires, there is an option to resend the invitation. This resend option appears in the list of admin users. This option will appear until the user logs-in successfully to Perception Point X-Ray.

If a user has been sent an invitation email, but has not yet signed-in to Perception Point X-Ray, you are not able to delete the user. Contact Perception Point Support [support@perception-point.io] for assistance.

Note: There is no additional cost for adding VIP users.

The VIP Users page is available to admin users with the "Cyber Analyst" [or higher] role.

Dialog box options

Organization

The organization that this VIP user is part of.

Display Name

The name that is commonly used to refer to this VIP user.

E.g. James Smith

Main Email Address

The main email address for this VIP user, in the organization.

E.g. James.Smith@acme.com

Additional Email Addresses

Any additional email addresses that are used by the VIP user. These email addresses may be from inside the organization, or they may be external email addresses. Use commas to separate multiple addresses.

E.g. James.Smith@gmail.com,James.Smith@yahoo.com,JSmith@gmail.com

[Every email that appears to originate from the VIP user, but that doesn't come from one of the listed email addresses for the VIP user, will be assigned a malicious verdict.

Display name protected

All VIP users have display name protection. You can't disable this protection.

VIP

Adds a VIP tag to all scan results for emails that are sent to the "Main Email Address" or to any of the "Additional Email Addresses" defined above. In the Scans-summary page, you can filter the emails to show only those emails that were sent to VIP users.

Any admin user with the "Self Analysis" role [or higher] can access the Disclaimers page.

Note:

If you enable disclaimers in a parent-organization, the disclaimers will be enabled in all child-organizations as well. If you want to enable disclaimers for a specific child organization only, select that organization in the Perception Point X-Ray banner before enabling the disclaimer.

When you enable disclaimers for an organization, DKIM checks may fail. See "Required configurations after enabling disclaimers" on page 20 below.

Disclaimers are always added at the top of an email - they can't be added at the end of an email. Disclaimers can't be relocated inside an email.

You can enable specific disclaimers for specific users. This is typically done for testing purposes. Contact Perception Point Support [support@perception-point.io] for details.

By default, disclaimers may not be compatible with Exchange 2019. If you are using Exchange 2019, see "Disclaimers with Exchange 2019" on page 22 below.

Note: If you activate a custom disclaimer in a parent organization, and a child organization has the default disclaimer active, two disclaimers may appear.

Subject: Customizing disclaimers

Hi Perception Point Support Team,

Organization name:

We would like to customize our disclaimers.

Please can you send us a zip file that contains all the default disclaimers - in HTML format.

We will make the required changes to the files, and then return the modified files to you.

Thank you

External

Added when an email is sent from an address that is outside your organization.

External - First Time

Added when an email is sent from an address that is outside your organization - and is sending an email for the first time to the recipient.

Unscanned Password Protected

Added when an email includes a password-protected file that was only partially scanned.

Display Name Deception

Added when an email is sent from a user who appears to be impersonating someone in your organization.

Spoofed Domain

Added when an email is sent from a domain that appears to be impersonating another domain.

Different Origin

Added when an email is sent by someone who is sending the email from a different path than is usually used by the sender.

SPF Hard Fail

Added when an email is sent from an IP address that is not authorized for the domain from which it was sent.

Note:

The disclaimers that you configure affect all child-organizations. If you want to modify a disclaimer for a specific child organization only, select that child organization in the Perception Point X-Ray banner before modifying the disclaimer.

When you enable disclaimers for your organization, DKIM checks may fail. See "Required configurations after enabling disclaimers" on page 20 below.

Note:

If the onboarding procedure was performed successfully, your configuration should already be as described below.

The following procedure is not required for integrations that use the Microsoft API connection method.

Note: Select the correct set of IP addresses for the environment of your organization.

What is the environment of your organization

In Perception Point X-Ray, go to Account > Preferences.

The Environment of your organization will appear under General > Info: US, EU, or AU.

For US environments

For EU environments

For AU environments

3.81.182.154

3.93.155.149

3.95.118.12

3.95.142.181

54.227.64.76

52.12.169.124 [required only if muti-region is enabled]

99.81.216.78

34.249.190.60

108.128.137.108

99.80.189.20

52.12.169.124 [required only if muti-region is enabled]

13.236.255.231

54.66.125.250

52.12.169.124 [required only if muti-region is enabled]

edgetransport.exe.config

key="DisableDetectEncodingFromMetaTag"

value="true"

Disabled

A disabled channel is not protected. If you want to protect a disabled channel, the channel must first be enabled and then activated.

Disabled channels appear in the Additional Channels section on the bottom of the Channels page.

For details on how to enable a disabled a channel, see "Enabling a channel" on page 29 below.

Enabled

An enabled channel is not protected. If you want to protect an enabled channel, the channel must be activated.

Enabled channels appear in the Enabled Channels section at the top of the Channels page.

Enabled channels are marked as being Inactive [

].

For details on how to activate an enabled channel, see "Activating a channel" on page 30 below.

Active

An active channel is protected by Perception Point X-Ray, and is called a protected channel.

Active channels appear in the Enabled Channels section at the top of the Channels page.

Active channels are marked as being Active [

].

Email Service

Only a single email service integration can be enabled at any time - either Microsoft 365 or Google Workspace.

Microsoft 365

[

]

Integration with Microsoft 365 uses the inline or the Microsoft API connection methods - with no MX record change.

Connection scope: Indicates which emails will be scanned: inbound, outbound, and internal.

For setup instructions, see Connecting Microsoft 365.

Account Takeover (ATO) detection

Detects if an email account has been taken-over. Requires integration of Perception Point X-Ray with Microsoft 365.

For setup instructions, see Configuring Microsoft 365 - ATO.

Outbound email scanning

Scans outgoing [outbound] emails to detect malicious file attachments and malicious URLs.

For setup instructions, see Onboarding Microsoft 365 - Outbound - API.

Google Workspace

[

]

Integration with Google Workspace uses inline integration - with no MX record change.

For setup instructions, see Connecting Google Workspace.

Browser Extension

Browser Security Extension

[

]

The ABS browser extension can scan downloaded files, and check web pages for malicious content.

For details, see Advanced Browser Security.

Browser Extension

[

]

Scans that were performed by the ABS Browser Extension.

For details, see Advanced Browser Security.

Google Drive

[

]

Helps to protect all the files in your Google Drive account. After you add Google Drive as a channel, Perception Point X-Ray will scan all files that are uploaded to Google Drive, and all files in Google Drive that are modified.

For details on how to configure the Google Drive integration, see Google Drive integration.

OneDrive

[

]

Helps to protect all the files in your Microsoft OneDrive account. When you add OneDrive as a channel, Perception Point X-Ray will scan all files that currently exist in OneDrive. Thereafter, Perception Point X-Ray will scan all files that are uploaded to OneDrive, and all files in OneDrive that are modified.

For details on how to configure the OneDrive integration, see OneDrive integration.

Dropbox

[

]

Helps to protect all the files in your Dropbox account. When you add Dropbox as a channel, Perception Point X-Ray will scan all files that currently exist in Dropbox. Thereafter, Perception Point X-Ray will scan all files that are uploaded to Dropbox, and all files in Dropbox that are modified.

For details on how to configure the Dropbox integration, see Dropbox integration.

Box

[

]

Helps to protect all the files in your Box account. When you add Box as a channel, Perception Point X-Ray will scan all files that currently exist in Box. Thereafter, Perception Point X-Ray will scan all files that are uploaded to Box, and all files in Box that are modified.

For details on how to configure the Box integration, see Box integration.

SharePoint

[

]

For details on how to configure the Microsoft SharePoint integration, see SharePoint integration.

Amazon S3

[

]

Enhance your Amazon S3 security by scanning every file that is uploaded to Amazon S3.

For setup instructions, see Amazon S3 integration.

Microsoft Teams

[

]

For details on how to configure the Microsoft Teams integration, see Microsoft Teams integration.

Slack

[

]

Enhance your Slack security by scanning every file that is uploaded to Slack - as an attachment to a conversation.

For setup instructions, see Slack integration.

SalesForce

[

]

For details on how to configure the Salesforce integration, see Salesforce integration.

Zendesk

[

]

Enhance your Zendesk security by scanning every file that is uploaded to Zendesk - as an attachment to a comment in a ticket.

For setup instructions, see Zendesk integration.

CrowdStrike

[

]

For details, see CrowdStrike integration.

SentinelOne

[

]

For details, see SentinelOne integration.

Cynet

[

]

For details, see Cynet integration.

Self Analyze

[

]

Scans that were performed using the Self Analyze feature in Perception Point X-Ray.

For details, see Self Analysis.

API

[

]

Scans that were performed using the files and urls APIs.

For details, see API - Files and API - URLs.

Note: Some of the enabled channels may be active and some may be inactive.

Note:

Before enabling a channel, contact your Customer Success Manager at Perception Point to make sure that the channel is included in your current Perception Point X-Ray license.

If you do not have permission to enable a channel, contact your Customer Success Manager at Perception Point.

Note: If the Edit button does not appear, you may not have permission to enable a channel. Contact your Customer Success Manager at Perception Point.

Note: If the Activate button doesn't appear, you may not have permission to enable a channel. Contact your Customer Success Manager at Perception Point.

The Protected Email Assets page is available to admin users with a "Cyber Analyst" [or higher] role.

Note: [Microsoft 365 Inline integrations only] If you have configured the integration to protect specified domains, groups, or users, information about the groups and users is not shown on this page.

"About protected email assets - Microsoft 365 API integrations" on page 33

"Full protection vs Partial protection" on page 34

"Editing the protected assets [this functionality is not yet available]" on page 35

"Asset details" on page 35

Note: Email assets that are protected by a Microsoft API integration are shown only for child organizations - the protected assets are not shown when a parent organization is selected in the Perception Point X-Ray banner.

Note: When the "protect all" option is selected, you won't be able to select a domain, and then disable or delete the domain. To delete or disable a domain, first change the organization protection to "Protect selected email assets only"

Note:

After you switch between the protection coverage modes, due to technical limitations, you won't be able to switch the coverage mode again for one hour.

The toggle controls affect Microsoft 365 API assets only - the controls do not affect Microsoft 365 Inline assets.

Enabling, disabling, and deleting assets

You can use the functionality on the Protected Email Assets page to enable, disable, or delete any of the protected assets.

The available controls are found on the right of each protected asset.

Adding assets

To add a domain, group, or user, click "Configure Email Protection" in the top-right corner. This will open the configuration wizard. For details, see Adding domains, groups, and users.

Domains

Shows all the Microsoft 365 API domains that have been added for the organization.

You can't add a domain using the functionality on this page. To add a domain to an existing integration, you'll need to perform the entire on-boarding process - see Onboarding Microsoft 365 [API].

Groups

Shows all the groups that were individually specified, that are currently available to be protected by Perception Point X-Ray.

You can't add a group using the functionality on this page. To add a group to an existing integration, you'll need to re-perform the entire on-boarding process - see Onboarding Microsoft 365 [API].

Users

Shows all the users that were individually specified, that are currently available to be protected by Perception Point X-Ray.

You can't add a user using the functionality on this page. To add a user to an existing integration, you'll need to re-perform the entire on-boarding process - see Onboarding Microsoft 365 [API].

Google Workspace

Connecting Google Workspace

Microsoft 365 - Inline

Step 1 - Onboarding Microsoft 365 [Inline]

Microsoft 365 - API

Onboarding Microsoft 365 [API]

Microsoft Exchange

Connecting Microsoft Exchange

"Other" email services

Connecting "other" email services

Note: You can't add a domain to any of the following existing integrations:

Microsoft 365 API

Microsoft Exchange

"Other"

In all of the above scenarios, to add a domain to an existing integration, it is necessary to re-perform the full on-boarding procedure. See the table above for details.

The required SMTP server is a server in your domain - as it appears in the MX record.

Important: Do not enter a value such as smtp.office365.com or outlook.office365.com or smtp.gmail.com.

Checking your SMTP server manually

You can perform the lookup procedure below to check that the SMTP server that appears is correct:

Open https://mxtoolbox.com/

In Domain Name, enter your domain name - and then click MX Lookup.

Your required SMTP server will appear under Hostname.

Continue with "Verifying your domains" on page 63.

Continue with "Verifying your domains" on page 63.

Any admin user with the "Admin" role [or higher] can access the Organizations page.

Configuration

For more information...

Allow lists

"Allow lists" on page 67

Block lists

"Block lists" on page 86

Disclaimers

"Disclaimers" on page 16

VIP users

"VIP users" on page 12

Custom logos

"Customizing Perception Point X-Ray" on page 104

Acme.com [Parent]

Acme.com [Main]

Active

[

] The organization is protected by Perception Point X-Ray.

[

] The organization is not protected by Perception Point X-Ray.

Risk Rating

The level of risk-rating that is applied to scans that are performed in the organization.

Low:

Medium:

High:

Organization ID

The ID of the organization.

This ID is generated by Perception Point X-Ray when the organization is created. This ID is never changed after an organization is added.

Name

The name of the organization.

Parent

The name of the parent organization.

Children

The number of child organizations below this organization.

Contract

The type of contract associated with the organization:

POC: This is a child organization.

Free: This is a child organization.

Commercial: This is a child organization.

NFR: This is a parent organization.

Billed users

The number of billed users in this organization.

Recipients

Protection

Possible options:

Follow URL: Species if URL links in emails should be clicked when the email is scanned.

When URLs are followed:

Exclude high reputation domains: Do not follow links that are included in high-reputation domains. Excluding high-reputation domains reduces the scanning time.

Exclude unsubscribe links: Do not click on unsubscribe links. This prevents unintended un-subscriptions from being performed during scans.

Block malicious: Shows which scan verdicts will be quarantined. Appears as Inactive if no scan verdicts are quarantined.

Channels

Shows which channels in the organization are enabled. For details about enabled channels, see "Channels" on page 23.

Note: A channel is protected only if it is enabled and then activated.

Page 1

General - Info

Organization name

The name of the organization.Note: After creating an organization, you can't modify the organization name - the organization name can be changed by Perception Point Support only. Contact Perception Point Support for assistance.

Parent organization

[This option may not be visible to all admin users]

The parent organization of the current organization.

The available options are the parent-type organizations in which you are a registered admin user.

Leave this field blank if the current organization is a parent organization - and therefore doesn't have a parent organization.

Environment

The AWS environment in which the data for your organization is stored in Perception Point X-Ray. You'll need to know the environment when you perform certain procedures during an integration of Perception Point X-Ray with another application, such as when you add the Perception Point X-Ray IPs to an allow list.

Risk rating

[This option may not be visible to all admin users]

The level of risk-taking associated with the organization:

Low:

Medium:

High:

Allow Multi-Region

Enables the Perception Point X-Ray multi-region functionality that helps to avoid data loss in the case of an AWS SES [Simple Email Service] outage - by enabling the transfer of emails between the AWS US and EU regions. For details, see "Multi-region" on page 55.

Escalation contacts

The email address or addresses to which emails will be sent by Perception Point X-Ray in case of an emergency, such as account takeovers and email delivery issues. The escalation contacts enable prompt resolution of urgent incidents. Providing an active 24/7 escalation contact address enables quick response to critical situations - minimizing disruptions, and ensuring the security and reliability of your account and emails.

Specifying escalation contacts is mandatory for all new organizations - and when you edit an existing organization. A group email address is recommended.

General - License

Status

Active: When not selected, the organization will not be protected by Perception Point X-Ray.

Inactive: If an organization has the status Inactive, and you want to make it active, contact Perception Point Support [support@perception-point.io]. Only Perception Point X-Ray can perform this procedure.

Organization type

[This option may not be visible to all admin users]

The Organization type defines the view/edit permissions:

Organization types that may have child-organizations:

MSSP:

Reseller:

Distributor:

Multi-organization: For direct organizations that have child-organizations for different business units, channels etc…

Organization types that can't have child-organizations:

Direct customer:

MSSP customer:

Indirect customer:

Contract type

[This option may not be visible to all admin users]

POC: Proof-of-Concept

Free:

Commercial:

NFR:

It will reduce license number by 15, if license source is integration.

(if we do billing according to number of licenses we get from MS or google)

If number source is manual (reported or purchased), then we do not reduce, as we assume CS will take it into account anyway.

Email reported seats

The number of seats that your organization will be billed for if the License source [see below] is set to Email reported seats.

Email purchased seats

The number of seats that your organization will be billed for if the License source [see below] is set to Email purchased seats.

License source

The source of the value for Active licenses: The options are:

Integration, or the specific integration [Microsoft 365 or Google Workspace]: The source of the number of seats to bill is the integration. The number is retrieved through the integration.

Reported seats: This option is for companies that report their number of seats, and don't have direct contract with Perception Point. This option is mainly for Acronis organizations and MSSP children. Select License source <Reported seats> and add a number. From that time, the specified number will be used as the license number for billing purposes.

Purchased seats: This option is for companies that have a direct contract (PO) with Perception Point, and is mainly for direct customers. Customer Service can select License source <Reported seats> and add a number. From that time, the specified number will be used as the license number for billing purposes.

The source for the number of seats that will be billed.

Integration: The source of the number of seats to bill is the integration. The number is retrieved through the integration.

Reported seats: The source of the number of seats to bill is the "Email reported seats" setting above.

Purchased seats: The source of the number of seats to bill is the "Email purchased seats" setting above.

Use organization for demo purposes

A demo organization has pre-defined demo scan data copied into the organization - and new scans can't be added. In addition, it is not possible to filter scans by date, and dates are blurred.

Only admin users with the Admin role can convert an organization into a demo organization. Organizations that already have scans or domains can't be converted into demo organizations.

General - Privacy

Incident response service

Basic:

Advanced:

Limited:

None:

Expose level

Public:

Limited:

Internal:

Delete clean scan files immediately

By default, emails that are assigned a clean verdict are maintained for 48 hours in Perception Point X-Ray. After 48 hours, the associated .eml file is deleted. For details, see Verdicts.

Select this option to delete the .eml files as soon as a clean verdict is assigned to an email - without waiting 48 hours.

Page 2

Channels

Lets you specify which channels are enabled in the organization.

For information about the Channels section, see "Channels" on page 23.

Page 3

Detection

For information about the Detection section, see Detection and Quarantine.

Reports

For information about the Reports section, see Printing reports.

Alerts

For information about the Alerts section, see "Alerts" on page 111.

Note: Since the secondary server is located in the US, and not in the EU, the multi-region functionality is not GDPR compliant.

Licensing: There are no additional licensing requirements for enabling the multi-region functionality.

IMPORTANT: The "Domains" page has been removed and replaced by the "Protected Email Assets" page. For details, see "Protected Email Assets" on page 31.

Permission: Any admin user with the "Controller" role [or higher] can access the Domains page.

For Google Workspace integrations only

Click ENABLE G-Suite APP 

You will be redirected to a page with instructions, and at the bottom, a place to enter an email address.

Keep this page open - you will return to this page later to complete this step, as described below.

In Google Workspace:

Go to your Google Workspace domain's Admin Console.

Click Security > Access and data control > API controls.

Scroll down to the Domain wide delegation section, and then select Manage Domain Wide Delegation.

Click Add new.

Under Client ID, enter 105845669529204264254

Add these scopes to the 0Auth scopes section:

https://mail.google.com/

https://www.googleapis.com/auth/admin.directory.user.readonly

https://www.googleapis.com/auth/admin.directory.group.readonly

Click Authorize.

In Perception Point X-Ray

In Perception Point X-Ray, in the field with the text "Your Email", enter your admin email address.

Click Submit.

The next step in the wizard appears.

For Microsoft 365 integrations only

Click ENABLE M365 APP

You will be redirected to sign-in to your Microsoft account.

Sign-in to your Microsoft account as a global admin.
You will see a list of the permissions that are required.

Click Accept.

The next step in the wizard appears.

For "Exchange" and "Other" integrations only

Click Next.

The next step in the wizard appears.

The required SMTP server is a server in your domain - as it appears in the MX record.

Important: Do not enter a value such as smtp.office365.com or outlook.office365.com or smtp.gmail.com.

Checking your SMTP server manually

You can perform the lookup procedure below to check that the SMTP server that appears is correct:

Open https://mxtoolbox.com/

In Domain Name, enter your domain name - and then click MX Lookup.

Your required SMTP server will appear under Hostname.

You must now verify the new domain or domains that you added. For details, see "Verifying your domains" on page 63.

Important: Before you request Perception Point Support [support@perception-point.io] to delete a verified domain, make sure that you do the following:

Note:

For each TXT record that you add, you will need the TXT record name and the TXT record value.

If multi-region functionality is enabled, you will need to add TXT records for both the primary region and the secondary region. [see "Multi-region" on page 55]

After adding a TXT record to your domain provider, don't remove the TXT record as long as you are connected to Perception Point X-Ray - as the TXT record allows Perception Point X-Ray to constantly authenticate with the DNS supplier.

Note

Other AWS products may use this method of domain verification. This is OK, as it is acceptable to have more than one _amazonses.domain record, as long as the record values are different.

Note

When you add a TXT record to your domain provider, it may take up to 72 hours for your domain provider to apply and replicate the change. Inform Perception Point Support [support@perception-point.io] if the domain is not verified after a few hours.

Note: If multi-region functionality is enabled, you'll need to verify TXT records for both the primary region and the secondary region. [see "Multi-region" on page 55]

If you are adding a domain to a new email integration:

If you are adding a domain to an existing email integration:

You must now perform Step 3 to configure the email service. For details, see:

See "Completing the process for existing integrations" on page 66 below.

Step 3 - Configuring Google Workspace

Step 3 - Configuring Microsoft 365 [Inline]

Step 3 - Configuring Exchange

Step 3 - Configuring "other" email systems

Old_domain|New_domain

Note: If the same item is included in both an allow list and a block list, the allow list will take precedence.

Sender email address allow list:

When an email is received from an email address that is included in the "Sender email address allow list", then you can select to:

not scan the email, and set the scan verdict to clean.

or

scan the email - without applying the spam scanning engines. A spam verdict is therefore not possible.

Recipient email address allow list:

When an email is sent to an email address that is included in the "Recipient email address allow list", then you can select to:

not scan the email, and set the scan verdict to clean.

or

scan the email - without applying the spam scanning engines. A spam verdict is therefore not possible.

Sender IP allow list:

When an email is received from an IP address that is included in the "Sender IP allow list", then you can select to:

not scan the email, and set the scan verdict to clean.

or

scan the email - without applying the spam scanning engines. A spam verdict is therefore not possible.

URL allow list:

When a URL that is included in the "URL allow list" should possibly be scanned, then you can select to:

not scan the URL, and set the scan verdict to clean.

or

scan the URL- without applying the spam scanning engines. A spam verdict is therefore not possible.

Hash allow list:

When file should possibly be scanned, if the hash of the file is included the "hash allow list," then the file will not be scanned, and the scan verdict will be set to clean.

The Allow List/Block List page is available to admin users with the "Cyber Analyst" role [or higher] only.

Note

It is possible to perform a bulk import of allow list entries. For details, contact Perception Point Support [support@perception-point.io].

Note: Allow list entries that are propagated from a parent organization are not visible in the child organizations.

Note:

For domains, don't include a wildcard character [*], a period [.], or an at sign [@] before the domain.

For example, *acme.com and *.acme.com and @acme.com are not valid formats.

Email addresses should be the email address only - without the sender name.

Subject: Bulk import of allow list entries

Hi Perception Point Support Team

Please add the attached allowlist entries, using the following settings:

Organization name:

Allow list:

Verdict option: "No review - always allow" or "Review if Malicious (allow if spam)"

SPF checks: Enable or Disable

Please let us know when this has been done.

Thank you

Note: When an SPF check is performed, if the sender fails the SPF check, the email will not be allow-listed [even though it is on the allow list], and may be assigned a malicious or spam verdict. This is done to prevent possible spoofing attempts. For further details, see "Disable IP/SPF Check" on page 76 below.

Organization

Select the organization to which the allow list applies.

Sender Email Address

Specify the email address of the sender. Emails from this sender email address will be allow-listed.

You can also specify a domain, such as acme.com. All email addresses inside the domain will be included in the allow list.

For example, if you specify acme.com:

All sub-domains in the "acme.com" domain will be included in the list.

This includes sub-domains such as legal.acme.com and drivers.acme.com

Don't include a wildcard character [*], a period [.], or an at sign [@] before the domain.

For example, *acme.com and *.acme.com and @acme.com are not valid formats.

Domain names are not case-sensitive.

Verdict

Specify which scans will be performed on emails and URLs that satisfy this allow-list entry:

No review - always allow: The email or URL will not be scanned, and the scan verdict will be set to clean.

No links in the email will be clicked.

Review if Malicious (allow if spam): The email or URL will be scanned:

The spam scanning engines won't be applied. A spam verdict is therefore not possible.

The malicious scanning engines will be applied. If the initial verdict is malicious, the scan will maintain its malicious verdict.

Note about restricted files

Scans of emails that include restricted files [that is, attachments that are in the list of restricted file types or URLs that include references to files that are in the list of restricted file types] will be handled as follows, depending on the option that you select:

No review - always allow: The scan will be set to clean.

Review if Malicious (allow if spam): The scan will be set to restricted, malicious, or clean - but never spam.

For details about restricted file types, see Restricted file types.

Comment

Add an optional comment.

Disable IP/SPF Check

When this option is selected, no IP/SPF checks will be performed for this email address - for the verdicts that are specified above [No review - always allow or Review if Malicious (allow if spam)]. Select this option when the sender has not set up an SPF record or the SPF record is broken or incorrectly configured.

See also: About SPF checks

Note: If you don't see a "successfully added" user notification, and if the entry that you tried to add doesn't appear in your allow list, this may indicate that the entry is included in the globally maintained allow list. For details, see "Global allow lists" on page 70.

Organization

Select the organization to which the allow list applies.

Recipient Email Address

Specify the email address of the recipient. Emails to this recipient will be allow-listed.

If you need to include a wildcard character [*] in the definition of an allow list, contact Perception Point support for assistance.

Verdict

Specify which scans will be performed on emails and URLs that satisfy this allow-list entry:

No review - always allow: The email or URL will not be scanned, and the scan verdict will be set to clean.

No links in the email will be clicked.

Review if Malicious (allow if spam): The email or URL will be scanned:

The spam scanning engines won't be applied. A spam verdict is therefore not possible.

The malicious scanning engines will be applied. If the initial verdict is malicious, the scan will maintain its malicious verdict.

Note about restricted files

Scans of emails that include restricted files [that is, attachments that are in the list of restricted file types or URLs that include references to files that are in the list of restricted file types] will be handled as follows, depending on the option that you select:

No review - always allow: The scan will be set to clean.

Review if Malicious (allow if spam): The scan will be set to restricted, malicious, or clean - but never spam.

For details about restricted file types, see Restricted file types.

Comment

Add an optional comment.

Note: If you don't see a "successfully added" user notification, and if the entry that you tried to add doesn't appear in your allow list, this may indicate that the entry is included in the globally maintained allow list. For details, see "Global allow lists" on page 70.

Organization

Select the organization to which the allow list applies.

Sender IP

Specify the IP address of the sender. Emails from this sender IP address will be allow-listed.

If you need to include a wildcard character [*] in the definition of an allow list, contact Perception Point Support [support@perception-point.io] for assistance.

By default, for security reasons, allow-listing a subnet [range] is not recommended. For possible implementation details, contact Perception Point Support [support@perception-point.io].

Verdict

Specify which scans will be performed on emails and URLs that satisfy this allow-list entry:

No review - always allow: The email or URL will not be scanned, and the scan verdict will be set to clean.

No links in the email will be clicked.

Review if Malicious (allow if spam): The email or URL will be scanned:

The spam scanning engines won't be applied. A spam verdict is therefore not possible.

The malicious scanning engines will be applied. If the initial verdict is malicious, the scan will maintain its malicious verdict.

Note about restricted files

Scans of emails that include restricted files [that is, attachments that are in the list of restricted file types or URLs that include references to files that are in the list of restricted file types] will be handled as follows, depending on the option that you select:

No review - always allow: The scan will be set to clean.

Review if Malicious (allow if spam): The scan will be set to restricted, malicious, or clean - but never spam.

For details about restricted file types, see Restricted file types.

Comment

Add an optional comment.

Note: If you don't see a "successfully added" user notification, and if the entry that you tried to add doesn't appear in your allow list, this may indicate that the entry is included in the globally maintained allow list. For details, see "Global allow lists" on page 70.

Note: "URL follow allow lists" have been deprecated. Existing "URL follow allow lists" will remain functional - but they can't be viewed or edited. For assistance with existing URL follow allow lists, contact Perception Point Support [support@perception-point.io].

The deprecated "URL follow allow list" functionality is replaced by "URL allow lists."

Organization

Select the organization to which the allow list applies.

URL

Specify the URL of sites that will be allow-listed. Use Method below to define how the URL string should be applied.

Method

Specify how the URL string defined above should be applied to determine which URLs to allow-list:

Starts with: A URL will be allow-listed if the URL starts with the URL string specified above.

In: A URL will be allow-listed if the URL includes the complete URL string specified above.

Domain ends with: A URL will be allow-listed if the URL ends with the URL string specified above.

Wildcard: An asterisk [*] included in the URL string above acts as a wildcard - representing any set of characters. If Wildcard is not selected, then an asterisk in the URL acts as an asterisk, and not as a wildcard.

If Wildcard is selected, but no asterisk [*] is specified in the URL string above, then each URL will be evaluated as if the "Exact" method has been selected.

Exact: A URL will be allow-listed if the URL is the exact URL string specified above.

Verdict

Specify which scans will be performed on emails and URLs that satisfy this allow-list entry:

No review - always allow: The email or URL will not be scanned, and the scan verdict will be set to clean.

No links in the email will be clicked.

Review if Malicious (allow if spam): The email or URL will be scanned:

The spam scanning engines won't be applied. A spam verdict is therefore not possible.

The malicious scanning engines will be applied. If the initial verdict is malicious, the scan will maintain its malicious verdict.

Note about restricted files

Scans of emails that include restricted files [that is, attachments that are in the list of restricted file types or URLs that include references to files that are in the list of restricted file types] will be handled as follows, depending on the option that you select:

No review - always allow: The scan will be set to clean.

Review if Malicious (allow if spam): The scan will be set to restricted, malicious, or clean - but never spam.

For details about restricted file types, see Restricted file types.

Apply to all channels

Select "Apply to all channels" so that the allow list will apply to scans that originate from any channel.

- or -

Clear "Apply to all channels" and then select the channels to which the allow list will apply.

Comment

Add an optional comment.

Note: If you don't see a "successfully added" user notification, and if the URL that you tried to add doesn't appear in your URL allow list, this may indicate that the URL is included in the globally maintained URL allow list. For details, see "Global allow lists" on page 70.

Organization

Select the organization to which the allow list applies.

SHA256

Specify the hash value. Any file with this hash value will not be scanned, and the scan verdict will be set to clean.

Comment

Add an optional comment.

Note: If you don't see a "successfully added" user notification, and if the entry that you tried to add doesn't appear in your allow list, this may indicate that the entry is included in the globally maintained allow list. For details, see "Global allow lists" on page 70.

Note: If the same item is included in both an allow list and a block list, the allow list will take precedence.

Sender email address block list

When an email is scanned, and the scan verdict is clean, if the email is sent from an email address that is included in the "Sender email address block list", then the scan verdict will be set to malicious or spam.

Sender IP block list

When an email is scanned, and the scan verdict is clean, if the email is sent from an IP address that is on the "Sender IP block list", then the scan verdict will be set to malicious or spam.

URL block list

When a URL is scanned, and the scan verdict is clean, if the URL is included in the URL block list, then the scan verdict will be set to malicious or spam.

Hash block list

When a file should possibly be scanned, if the SHA-256 hash of the file is included in the "hash block list," then the file won't be scanned, and the scan verdict will be set to malicious.

The Allow List/Block List page is available to admin users with the "Cyber Analyst" role [or higher].

Note: It is possible to perform a bulk import of block list entries. For details, see "Bulk import of block list entries" on page 88 below, or contact Perception Point Support [support@perception-point.io].

Note: Block list entries that are propagated from a parent organization are not visible in the child organizations.

Note:

For domains, don't include a wildcard character [*], a period [.], or an at sign [@] before the domain.

For example, *acme.com and *.acme.com and @acme.com are not valid formats.

Email addresses should be the email address only - without the sender name.

Subject: Bulk import of blocklist entries

Hi Perception Point Support Team

Please add the attached blocklist entries, using the following settings:

Organization name:

Blocklist:

Verdict option: Malicious or Spam

Please let us know when this has been done.

Thank you

Organization

If this option appears, select the organization to which the block list applies.

Sender Email Address

Specify the email address of the sender. Emails that originate from this email address will be block-listed.

You can also specify a domain, such as acme.com. All email addresses inside the domain will be included in the block list.

For example, if you specify acme.com:

All sub-domains in the "acme.com" domain will be included in the list.

This includes sub-domains such as legal.acme.com and drivers.acme.com

Don't include a wildcard character [*], a period [.], or an at sign [@] before the domain.

For example, *acme.com and *.acme.com and @acme.com are not valid formats.

Domain names are not case-sensitive.

Verdict

Select the verdict that will be applied to scans of emails that were sent from an email address that is included in the "Sender email address" [see above], either Malicious or Spam.

For details on what happens to emails that are assigned a malicious or spam verdict, see Verdicts.

Comment

Add an optional comment.

Exclude email from the following

When an email is blocked due to this block list definition, then the email will be excluded from the following [as selected]:

Admin alerts: For details, see "Alerts" on page 111.

End user alerts: For details, see "Alerts" on page 111.

Digest reports: For details, see Sending daily quarantine reports.

Note: If you don't see a "successfully added" user notification, and if the entry that you tried to add doesn't appear in your block list, this may indicate that the entry is included in the globally maintained block list. For details, see "Global block lists" on page 87.

Organization

If this option appears, select the organization to which the block list applies.

Sender IP

Specify the IP address of the sender. Emails that originate from this IP address will be block-listed.

By default, block-listing a subnet is not supported. For possible implementation details, contact Perception Point Support [support@perception-point.io].

Verdict

Select the verdict that will be applied to scans of emails that were sent from the "Sender IP" [see above], either Malicious or Spam.

For details on what happens to emails that have been assigned a malicious or spam verdict, see Verdicts.

Comment

Add an optional comment.

Exclude IP from the following

When an email is blocked due to this block list definition, then the email will be excluded from the following [as selected]:

Admin alerts: For details, see "Alerts" on page 111.

End user alerts: For details, see "Alerts" on page 111.

Digest reports: For details, see Sending daily quarantine reports.

Note: If you don't see a "successfully added" user notification, and if the entry that you tried to add doesn't appear in your block list, this may indicate that the entry is included in the globally maintained block list. For details, see "Global block lists" on page 87.

Organization

If this option appears, select the organization to which the block list applies.

URL

Specify the URL of sites that will be block-listed. Use Method below to define how the URL string should be applied.

Method

Specify how the URL string defined above should be applied to determine which URLs to block-list:

Starts with: A URL will be block-listed if the URL starts with the URL string specified above.

In: A URL will be block-listed if the URL includes the complete URL string specified above.

Domain ends with: A URL will be block-listed if the URL ends with the URL string specified above.

Wildcard: An asterisk [*] included in the URL string above acts as a wildcard - representing any set of characters. If Wildcard is not selected, then an asterisk in the URL string acts as a single asterisk character, and not as a wildcard.

If Wildcard is selected, but no asterisk [*] is specified in the URL string above, then each URL will be evaluated as if the " Exact" method has been selected.

Exact: A URL will be block-listed if the URL is the exact URL string specified above.

Apply to all channels

Select "Apply to all channels" so that the block list will be applied to all channels.

- or -

Clear "Apply to all channels" and then select the channels that will be affected by the block list.

Verdict

Select the verdict that will be applied to scans of URLs that are included in "Method" [see above], either Malicious or Spam.

For details on what happens to emails that have been assigned a malicious or spam verdict, see Verdicts.

Comment

Add an optional comment.

Exclude url from the following

When an email is blocked due to this block list definition, then the email will be excluded from the following [as selected]:

Admin alerts: For details, see "Alerts" on page 111.

End user alerts: For details, see "Alerts" on page 111.

Digest reports: For details, see Sending daily quarantine reports.

Note: If you don't see a "successfully added" user notification, and if the entry that you tried to add doesn't appear in your block list, this may indicate that the entry is included in the globally maintained block list. For details, see "Global block lists" on page 87.

Note: Only SHA-256 hashes are supported. MD-5 hashes and SHA-1 hashes are not supported.

Organization

If this option appears, select the organization to which the block list applies.

SHA256

Specify the SHA-256 hash value. Any file with this hash value will not be scanned, and the scan verdict will be set to malicious.

Comment

Add an optional comment.

Note: If you don't see a "successfully added" user notification, and if the entry that you tried to add doesn't appear in your block list, this may indicate that the entry is included in the globally maintained block list. For details, see "Global block lists" on page 87.

Organization name

The name of the organization.

Parent organization

[This option may not be visible to all admin users]

The parent organization.

Environment

The AWS environment in which the data for your organization is stored in Perception Point X-Ray. You'll need to know the environment when you perform certain procedures during an integration of Perception Point X-Ray with another application, such as when you add the Perception Point X-Ray IPs to an allow list.

Risk rating

[This option may not be visible to all admin users]

The level of risk-taking associated with the organization:

Low:

Medium:

High:

Multi-region

Enables the Perception Point X-Ray multi-region functionality that helps to avoid data loss in the case of an AWS SES [Simple Email Service] outage - by enabling the transfer of emails between the AWS US and EU regions. For details, see "Multi-region" on page 55.

Escalation contacts

The email address or addresses to which emails will be sent by Perception Point X-Ray in case of an emergency, such as suspected account takeovers and email delivery issues. The escalation contacts enable prompt resolution of urgent incidents. Providing an active 24/7 escalation contact address enables quick response to critical situations - minimizing disruptions, and ensuring the security and reliability of your account and emails.

Specifying escalation contacts is mandatory for all new organizations - and when you edit an existing organization.

A group email address is recommended.

General - License

Status

Active: When selected, the organization may be protected by Perception Point X-Ray.

Inactive: When not selected, the organization is not be protected by Perception Point X-Ray.

Activating or deactivating an organization

Admin users in a parent organization [MSSP/Reseller/Distributor/Multilevel] can activate or deactivate only the child organizations - not the parent organization.

Admin users in child organizations can't activate or deactivate the organizations.

Organization type

[This option may not be visible to all admin users]

The Organization type defines the view/edit permissions of admin users in the organization - in Perception Point X-Ray:

Organization types that may have children:

MSSP: This organization is primarily used to manage all the child organizations. No channels [email integrations or other integrations] can be configured on these organizations. All integrations must be configured on child organizations. A child organization is created automatically when an MSSP organization is created.

Reseller:

Distributor:

Multi-organization: For direct organizations that have children for different business units, channels etc.

Organization types that can't have children:

Direct customer:

MSSP customer:

Indirect customer:

Contract type

[This option may not be visible to all admin users]

POC: Proof-of-Concept

Free:

Commercial:

NFR:

It will reduce license number by 15, if license source is integration.

(if we do billing according to number of licenses we get from MS or google)

If number source is manual (reported or purchased), then we do not reduce, as we assume CS will take it into account anyway.

Email reported seats

This option is typically for companies that report their number of seats, and don't have direct contract with Perception Point. This option is mainly for Acronis organizations and MSSP children. Select License source <Reported seats> and add a number. From that time, the specified number will be used as the license number for billing purposes.

The number of seats that your organization will be billed for if the License source [see below] is set to Reported seats.

Email purchased seats

This option is for companies that have a direct contract (PO) with Perception Point, and is mainly for direct customers. Customer Service can select License source <Purchased seats> and add a number. From that time, the specified number will be used as the license number for billing purposes.

The number of seats that your organization will be billed for if the License source [see below] is set to Purchased seats. This number is specified in the contract.

License source

The source for the number of seats that will be billed.

Integration, or the specific integration [Microsoft 365 or Google Workspace]: The source of the number of seats to bill is the integration. The number is retrieved through the integration.

Reported seats: The source of the number of seats to bill is the "Email reported seats" setting above.

Purchased seats: The source of the number of seats to bill is the "Email purchased seats" setting above.

Dispute: The source of the number of seats to bill is the "Dispute" setting above.

Partial protection approved

[This option may not be visible to all admin users]

"Partial protection - Requested" indicates that the organization doesn't want to protect the entire account - but rather wants to protect only a subset of the email addresses in the organization account.

"Partial protection - Not requested" indicates that the organization hasn't requested to protect only a subset of the email addresses in the organization account.

General - Privacy

Incident response service

IR Monitoring Level

Basic: The Perception Point IR Team can review PII that is included in any scan that is not clean - to be able to identify false positives. The Perception Point IR Team can also review any clean scan that the customer has requested to investigate.

Advanced: The Perception Point IR Team can review PII of any scan to be able to identify false negatives and false positives.

Limited: The Perception Point IR Team can review PII only of scans the customer has requested to investigate.

None: The Perception Point IR Team can't review PII of any scan.

Expose level

Public: Expose only to public data - most of organizations (default - 0.1)

Limited: Customer is exposed to internal data.

Internal: Customer is exposed to limited data.

Delete clean scan files immediately

By default, emails that are assigned a clean verdict are maintained for 48 hours in Perception Point X-Ray. After 48 hours, the associated .eml file is deleted. For details, see Verdicts.

Select this option to delete the .eml files as soon as a clean verdict is assigned to an email - without waiting 48 hours.

IMPORTANT:

Some of the functionality on this page may not yet be available. For details on availability, contact Perception Point Support [support@perception-point.io].

Note:

The customization settings affect only the selected organization. If the selected organization is a parent organization, the child organizations are not affected by these customization settings.

The end user report customization settings affect only the end user "malicious incident alert emails" and Digest reports - the settings don't affect the weekly, monthly, domain, or Drive reports.

Organization Logo

Custom Logo

The custom logo replaces the "Perception Point X-Ray" logo in various places. You specify the places below. Replacing the default logo is done for white-labeling or branding purposes.

Click Upload Image to upload the file that contains your organization logo.

Your logo file must be in jpg, jpeg, or png format.

The maximum size of your logo file is 200 KB.

Display the logo in the following locations

Specify where the custom logo [uploaded above] will be displayed:

Xray UI: Replaces the Perception Point X-Ray logo with your organization's logo - on the left side of the Perception Point X-Ray banner.

End-user alerts: Replaces the Perception Point logo with your organization's logo in alert emails that are sent to end-users.

Digest reports: Replaces the Perception Point logo with your organization's logo at the top of Digest reports. For details on Digest reports, see Digest reports.

Periodic reports: Replaces the Perception Point logo with your organization's logo in the top-left corner of all Periodic reports. For details on Periodic reports, see Periodic reports.

Display different custom logo for Xray UI dark theme

Lets you upload a custom logo that will be displayed on the left side of the Perception Point X-Ray banner when the dark theme is used. For details on the dark theme, see "Selecting the display theme" on page 6.

Your logo file must be in jpg, jpeg, or png format.

The maximum size of your logo file is 200 KB.

This option appears only if the custom logo is selected to be displayed in the "Xray UI" [see above].

End-user email alerts and reports

Sender display name

Replaces the default Sender display name in:

"malicious incident alert emails" that are sent to end-users

Digest reports

By default, the Sender display name is "Perception Point"

"Reply to" email address

Replaces the default Reply-to email address in:

"malicious incident alert emails" that are sent to end-users

Digest reports

By default, the Reply-to email address is "support@perception-point.io"

The specified Reply-to address will be the target address when users click "Reply" in a customized alert email or Digest report.

"Contact us" email address

By default, "malicious incident alert emails" and Digest reports include the message below [without a "contact us" link at the end]:

If you specify a "Contact us" email address, then the above message is modified to include a "contact us" link:

When a user clicks "contact us", an email message will be opened, addressed to the specified "Contact us" email address. This simplifies the process of requesting quarantined emails to be released.

Send test email

Sends a test "malicious incident alert email" - that incorporates all the custom settings above. This enables you to check that the customized "malicious incident alert emails" are correctly configured. You can specify one-or-more email addresses to which to send the test email.

Time Zone

Organization time zone

[This functionality may not yet be available]

By default, the times that appear in all alerts and reports - that are sent by email - are UTC times. If you select a time zone for your organization, all alerts and digest reports will be based on the selected time zone. The selected time zone will be applied to periodic reports in future releases.

Note: If the email includes a suspected malicious QR code, a preview of the email may not be available in the alert email. This is to prevent users from mistakenly accessing the potentially malicious QR code in the preview.

Note:

You can also send Digest reports - that include a list of all emails and files that were assigned specified verdicts during the reporting period. For details, see Digest reports.

By default, the times that appear in alerts are UTC times. You can specify a time zone for your organization, and then all alerts will be based on the specified time zone. For details, see "Time Zone" on page 110.

The Alerts functionality is available to admin users with the "Administrator" role only.

Important: To ensure that the alert emails arrive in the recipient's Inbox [and are not classified as spam], add the following email address to an allowlist in your email service:

Admin alerts and reports

Alert via email on malicious incidents

When selected, an alert email will be sent each time an email or a file is assigned a malicious scan verdict.

The alert email is sent irrespective of whether or not the email or file was quarantined.

Recipients: Defines which admin users will be sent the alert emails that are enabled above:

All admin users: The alert emails will be sent to all Perception Point X-Ray admin users in your organization [not to additional admin users in the parent organization].

Specific users: The alert emails will be sent to the specified admin-user email address or addresses.

Alert via email on malicious cases

When selected, an alert email will be sent each time a case is added to the Cases page. For details about cases, see Cases.

Recipients: Defines which admin users will be sent the alert emails that are enabled above:

Same as escalation contacts: The alert emails will be sent to the escalation contacts. For details, see "Escalation contacts" on page 99.

All admin users: The alert emails will be sent to all Perception Point X-Ray admin users in your organization [not to additional admin users in the parent organization].

Same as malicious incidents: The alert emails will be sent to the recipients that are defined [above] to receive alert emails about malicious incidents.

Specific users: The alert emails will be sent to the specified admin-user email address or addresses.

End user alerts and reports

Alert via email on malicious incidents

An alert email will be sent each time an email or a file is assigned a malicious scan verdict.

The alert email is sent irrespective of whether or not the email or file was quarantined.

The warning email will be sent to the intended recipient of the original email or to the owner of the file. The "warning" email will have the subject similar to "A malicious email has been detected and blocked"

If the recipient of the alert email thinks that the email or file is not malicious, the recipient can request their IT security team to investigate the scan - and to release the email or file from quarantine, if the email was quarantined.

Receive digested incidents report on selected verdicts

Specifies if Digest reports will be sent to end-users. For details, see Digest reports.

The Audit Log page is available to admin users with the "Administrator" role only.