Endpoint Digest Email

[Tony_Graham]

I receive weekly 'digest' emails in the form of a Weekly Security Report from Harmony Endpoint Cloud.

In this weeks report I have an entry that states:

Prevented Zero-Day Phishing Attacks: 1

However, that statistic does not match Infinity Portal reporting which states there are no attacks.

I have run Threat Hunting using the date range and it returns no mention of this event either.

It does however show up in the logs which I assume is where the automated report picked up on it.

Ultimately it's a non-issue but I thought it was odd that the event is mentioned/visible nowhere except the

report and the log.

[PhoneBoy]

Curious what the event was that was flagged?
Feel free to post a screenshot with the sensitive details redacted.

[Tony_Graham]

Sure. It was a ZeroPhishing notification lodged against an internal website.

[Tony_Graham]

Actually today I am getting Loading Threat Hunting with a circle spinning for a

long while, then the Threat Hunting panel draws and I see 'No data available for hunting'.

It must be down today. **Update - Looks like there is an issue.

Possible slow down or failure getting dataSubscribe

Identified - The issue is identified and a fix is begin implemented
Jun 15, 2023 - 14:17 UTC

Investigating - Issue is currently under investigation
Jun 15, 2023 - 13:18 UTC

[PhoneBoy]

It's interesting the log entry is "Detect" rather than "Prevent" which is maybe why Threat Hunting didn't pick it up...

[Tony_Graham]

Perhaps more interesting is all settings are on prevent.

[PhoneBoy]

Feels like how Anti-Bot used to flag the DNS Trap as "detect" under similar circumstances.
Not 100% sure this is expected, though.