topic Re: Enpoint Digest Email in Endpoint

Endpoint Digest Email

Tony_Graham — Tue, 20 Jun 2023 17:50:02 GMT

I receive weekly 'digest' emails in the form of a Weekly Security Report from Harmony Endpoint Cloud.

In this weeks report I have an entry that states:

Prevented Zero-Day Phishing Attacks: 1

However, that statistic does not match Infinity Portal reporting which states there are no attacks.

I have run Threat Hunting using the date range and it returns no mention of this event either.

It does however show up in the logs which I assume is where the automated report picked up on it.

Ultimately it's a non-issue but I thought it was odd that the event is mentioned/visible nowhere except the

report and the log.

PhoneBoy — Thu, 15 Jun 2023 19:29:36 GMT

Curious what the event was that was flagged?
Feel free to post a screenshot with the sensitive details redacted.

Tony_Graham — Thu, 15 Jun 2023 20:17:11 GMT

Sure. It was a ZeroPhishing notification lodged against an internal website.

Tony_Graham — Thu, 15 Jun 2023 20:28:08 GMT

Actually today I am getting Loading Threat Hunting with a circle spinning for a

long while, then the Threat Hunting panel draws and I see 'No data available for hunting'.

It must be down today. **Update - Looks like there is an issue.

Identified - The issue is identified and a fix is begin implemented
Jun 15, 2023 - 14:17 UTC

Investigating - Issue is currently under investigation
Jun 15, 2023 - 13:18 UTC

PhoneBoy — Thu, 15 Jun 2023 20:55:31 GMT

It's interesting the log entry is "Detect" rather than "Prevent" which is maybe why Threat Hunting didn't pick it up...

Tony_Graham — Fri, 16 Jun 2023 15:13:51 GMT

Perhaps more interesting is all settings are on prevent.

PhoneBoy — Fri, 16 Jun 2023 20:17:21 GMT

Feels like how Anti-Bot used to flag the DNS Trap as "detect" under similar circumstances.
Not 100% sure this is expected, though.