A phishing email bypassed the Check Point security controls

[Nishanthan]

We are experiencing an issue with Harmony Email security and would like your assistance.

• On 8th September, a phishing email was successfully blocked by Harmony Email.

• On 19th September, a similar phishing email from a different sender was delivered to the customer’s mailbox.

• The phishing email on 19th September was not blocked by Harmony Email and we were unable to find any related logs for this event.

• Email tracing shows that the message hit the Microsoft external email header policy, but it did not trigger any Check Point policy enforcement.

• Despite this, the email still reached the customer mailbox.

Concerns / Questions:

1. Why did Harmony Email fail to block the phishing email on 19th September?

2. Why are there no Harmony Email logs for this email?

3. Why was the message processed only under Microsoft’s external header policy and not evaluated by Check Point’s security controls?

[G_W_Albrecht]

Do you have a SR# wuth CP TAC open already to get these questions answered?

[the_rock]

For something like this, I would definitely open TAC case. In the meantime, are there any relevant logs you can send us?

Andy

[PhoneBoy]

Specific instances of false positives/false negatives should be addressed via TAC.