Zero Phishing is set to Prevent mode but Detect in logs

[62742738]

Hi everyone!

Can someone please help me, I'm just wondering why in the logs the action for Zero Phishing blade is Detect. But upon checking the policy, it is set to Prevent mode. See attached screenshots.

Why is it different? It should be Prevent in the logs as well right? Does anyone of you experienced this or am I missing out on something? Kind of a newbie in HEP 😄

[AdiGH]

Hey,

Are all your rules set to prevent for zero phishing and password reuse? 

When you start with HEP the default policy is set to Detect, is it possible that on of the rules is still in detect mode?

[62742738]

Yes, it is all in prevent mode. Even the default one is changed to Prevent mode.

[the_rock]

I would do quick remote with TAC, Im sure something rudimentary is missing.

Best,

Andy

[lluner]

hi 

I checked that my policy is prevented and shows detect for sites with http

All these alerts are http related

All policies are in preventive mode

[Chris_Atkinson]

Any exclusions configured?

[lluner]

Hi , Cris

For these sites no

[andreyta]

Hello,

Those are detect events for sites that were scanned by Zero Phishing. The extension did not recognize them as phishing (which means that the login to them were not prevented) but they were detected to be suspicious because they are http sites with login page. 

[lluner]

tks. @andreyta