Issue:

Microsoft Excel, Word and PowerPoint files including malicious URL were detected in SharePoint, OneDrive and Teams.

Malicious URL in text file(.txt) was not detected.
Also, malicious URL shared in teams chat was not detected.

Are these all expected bahavior?

Resolution:

This feature was implemented in our Security Cloud on February 2024

Regarding this question, our Security Cloud does not look at the file extension, but it looks at the file type.
File Types that are currently supported with this behavior are:

MicrosoftExcel 
MicrosoftWord 
MicrosoftPowerPoint 
PDF  
OpenDocumentPresentation 
OpenDocumentSpreadsheet 
OpenDocumentText

As for PDF file, URLs are needed to be linked with Hyperlink.
Press enter or space after typing in the URL before saving it as PDF, the URL will be linked with hyperlink, which will trigger detection.

Issue:

Is there any way to filter quarantined files by file name or URL in Exchange on Elements Collaboration Protection?
It seems that other cloud services like SharePoint, OneDrive and Teams have a filter by file name, but there's no such filtering rule for Exchange.

Resolution:

Unfortunately it is not possible to filter out by file name or URL name in Exchange, because the data is stored based on the email's Message ID, which is different compared to SharePoint, OneDrive and Teams.

Issue:

Maximum number of URLs that can be configured Exchange policy in Collaboration Protecion

Policies > Exchange > URL scanning > Trusted websites > Websites
Policies > Exchange > URL scanning > Blocked websites > Websites

Resolution:

There is no maximum number of URLs. but there is an limit for the entire policy settings all together (and not field-by-field limit).

Issue:

We have changed our domain name, but Microsoft 365 tenant itself is same as before.
In this case, do we need to change any settings in Elements Collaboration Protection(ECP) side?
So far, old domain name remains in some places in portal.
For example, there are some old domain records remaining in Exchange page and the status is shown as unavailable. Will those old domain records be deleted automatically?
 

Resolution:

Customer doesn't need to do anything, as the old domain should be deleted automatically in 14 days of being unavailable.

Every time we open summary page in portal, which shows tenant's detailed info, ECP will send API to Microsoft to get the information displayed.
Specifically which part of Microsoft is referred to, or what API is used, is not disclosed.

Issue:

A lot of emails from trusted senders are quarantined due to including malicious URLs. Is it possible to add a domain or address as a trusted sender in Cloud Protection for Microsoft 365?

Resolution:

If a lot of emails are quarantined due to malicious URLs from trusted senders, you can add them to the trusted senders list by following these steps:

1. Log into Cloud Protection Portal
2. Go to Policies 
3. Select policy
4. Go to the General settings
5. Turn on the Trusted senders feature
6. Add the trusted email sender or domain addresses
7. Click Save

From the Cloud services page in the portal you can assign different policies for your cloud services. 
 

Issue:

Admin received a notification that there is a suspicious inbox rule, advise user to remove the rule. Admin wants to verify that suspicious rule is already removed. 

Resolution:

At the moment Collaboration Protection will only report those suspicious inbox rules but do not list the user's rules, admin needs to check directly with user or check if the same suspicious rule is reported again. 

Issue:

Incoming email was delayed to be detected and quarantined on Elements Collaboration Protection and the receiver could see the email and has already sent reply it.

In the end, the reply was also quarantined but not sent to any destination addresses.
This issue happened only one time and cannot be reproduced again.

Resolution:

Generally, delays can happen because our Elements Collaboration Protection system is working in asynchronous way with Microsoft, therefore delays are expected to happen from time to time.

Issue:

How to report a false positive or negative for Elements Collaboration Protection?

• Harmless website / link / webpage / attachment file blocked and email has been quarantined (false positive)
• Harmful website / link / webpage / attachment file has been allowed through (false negative)

Resolution:

If you suspect the detection to be a false positive or negative, submit the file or URL sample to our labs to have the detection corrected. How to proceed for the submissions is documented in our Help Guide page with the link to our labs page: Creating and Viewing Sample Validation Requests in the Request Views | Welcome to WithSecure Elements | Latest | WithSecure User Guides 

It usually takes our labs 24-48h to have the file or URL analyzed and have the detection corrected. 

The URL can also be reported directly from the Elements Collaboration Protection portal's Security alerts page. 

If the email is urgent and the cause for the quarantine is a possibly malicious URL, you can add the URL to Trusted websites by using these steps:

1. Log in to the Elements Collaboration Protection portal
2. Go to the Policies page
3. Select a profile you want to edit
4. Select the Exchange online > URL scanning
5. Scroll down to the Trusted websites section and enable it
6. Enter the domain address in the Websites field
7. Click Save

Issue:

How to disable or turn off protection for a specific / certain / single mailbox for Elements Collaboration Protection?

Resolution:

You can remove mailboxes from being protected by following these steps: 

1. Login to the Elements Collaboration Protection portal
2. Select Cloud services on the sidebar
3. Select Configure protection in the row of the new connection in the Exchange column
4. In the page that opens you should first select Customize protection for mailboxes as this allows you to choose which mailboxes should be protected
5. After this you can simply go through the list of mailboxes and choose the mailboxes you wish to make changes to and choose Turn off protection

Issue:

When configuring compromised accounts in Cloud Protection for Office 365, I would like only the administrator to receive notification if an account is found compromised.

Resolution:

You have the option under Compromised accounts in your policies to notify the administrator and the users. These both options are selected by default. You can uncheck the Notify the user option under Compromised accounts and users will not be notified anymore.