Threat Extraction Tags all Messages as Malicious

lincolnwebber — Mon, 04 Apr 2022 20:55:01 GMT

Hi Guys,

After configuring forwarding of logs from Cloudguard SaaS to on-prem management and exporting logs from there to syslog for SIEM correlation, the customer complains that all emails with attachments trigger threat extraction events and are seen as malicious. Can someone explain whether the solution is working as intended and if so, how should this be integrated with a SIEM to provide useful security events for email attachments?

Re: Threat Extraction Tags all Messages as Malicious

PhoneBoy — Tue, 05 Apr 2022 01:01:03 GMT

Actual screenshots of what is reported in the SIEM versus what is reported in the Infinity Portal would be helpful.

topic Re: Threat Extraction Tags all Messages as Malicious in Email and Collaboration

Threat Extraction Tags all Messages as Malicious

Re: Threat Extraction Tags all Messages as Malicious