Phish Focus : Block List

This feature allows a Phriendly Phishing Admin to connect Phish Focus to your MS tenant and easily update the Block List from within Phish Focus. As an Admin, you can review reported emails in Phish Focus and create a block list entry. That block list entry updates to your MS 365 mail server block list and moves future emails from same entries to either your users' Junk folder or quarantined automatically.

This article covers below

• Enable Block List
• Disconnect from MS 365 Tenant
• Create Block List Entries from an Email
• Manage Block List Entries
• Block List Activity Logs
• Synchronisation between Phish Focus and MS 365 Tenant

Enable Block List

Block List is a configurable option by the Admins and by default this button is disabled. Refer to below steps on how to enable the feature:

1. From the Phriendly Phishing platform, click Phish Focus.
2. Clicks Settings > Enable Block List
3. Connect to MS 365 Tenant. You are required to log-in to your MS 365 Tenancy and accepts to grant Phish Focus to connect and use permissions.
4. Once logged in successfully, the below notification will appear. Click OK.
5. After clicking, OK you will see your Tenant ID and User ID

Log out or disconnect from MS 365 Tenant

As an Admin you can log-out if you want to remove the connection to your MS Account by clicking Log-out or disconnect from the tenant. 

Log-out

Disconnect from Tenant

Create Block List Entries from an Email

Once Block List is enabled and the connection to MS 365 tenant is successful, Admins can now create block list entries which are synchronised with MS 365 Blocklist. 

Block List entries are created from the body of the email which includes: 

1. Sender Email Address
2. URL in the Email content
3. File Hash of the email's attachment

See steps below to create a Block List:

1. Click the reported email > Actions > Add to Block List   
   
2. A pop-up dialogue box below appears, for you to choose which information to block. Click Save.   
3. Once Saved, while information is syncing to MS 365 Server, status appears as Pending. Once sync has completed, status now appears as Action under Block List.

Manage Block List Entries

As an admin you have visibility and can manage the block list entries for your zone. Refer to below lists:

• Value
• 3 Attribute Types the entry could be: Sender, URL, and File Hash
• Created Date (date value was created) 
• Expiration date (date value is set to expire - could be: Never expire, 7 days, or 30 days)
• Synced status: Pending, Active, Failed or Expired.
• Action: Edit, Delete

Synched Status
Below status indicates if the entered value is synced or connected to the MS service successfully or not. Synched status can be filtered. 

• Pending = value is in the process of being added or deleted from the MS 365 blocklist.
• Active = value is successfully added to the blocklist and synced with the connected MS 365 mail server.
• Failed = value is not successfully added and synced. It could be because of an existing entry in MS 365 and cannot be duplicated.
• Expired = value has expired. When it reaches the expiration date, it is removed from the MS 365 block list and status in Phish Focus is “Expired”.

Action
As a Phriendly Phishing Admin, you can action a value dependent on the synced status. Edit, allows an Admin to change the expiration date and Delete allows an admin to remove the whole value from the block list. 

• Pending: Delete
• Active: Edit, Delete
• Failed: Delete
• Expired: Edit, Delete

Block List Activity Logs

All activities of Block List feature are logged in Activity Logs. This section shows below information:

• Modified Date and Time
• Value: name of the entry which has been modified
• Action type:
  • Created
  • Deleted
  • Edited
  • Expired
• Done by, which could be any of the below:
  • An Admin who performed the action
  • System
  • Synced from MS 365 - action caused by syncing data from MS 365 block list.

As an Admin, you can download the logs as a CSV file.

Synchronisation between Phish Focus and MS 365 Tenant

This section provides Admins an insight on the sync process happening after adding an entry in the block list. 

From Phish Focus:

• If a value is created from Phish Focus → it is added to the MS 365 block list
• If a value is updated from Phish Focus (expiration date) → it is updated to the MS 365 block list
• If a value is deleted from Phish Focus → it is removed from the MS 365 block list

From MS 365 Block List:

• If a value is created from MS 365 block list → NO CHANGE or UPDATE in Phish Focus.
• If a value is updated from MS 365 block list (expiration date) → it is updated in Phish Focus and a log is recorded under activity logs
• If a value is deleted from MS 365 block list → it is removed in Phish Focus and a log is recorded under activity logs
• If a value is auto-removed from MS 365 block list when it reaches the expiration date → it shows as Expired in Phish Focus