Product Brief Email Threat Detection

Response and Isolation

KEY FEATURES Stop targeted and advanced email attacks with
• Detect complex and stealthy powerful protection that includes complete visibility,
advanced attacks with cloud-based
prioritized response, and automated remediation.
sandboxing capabilities.
• Stop malicious links weaponized Prevent the Most Advanced Email Attacks
after email delivery with Click‑Time
Symantec® Email Threat Detection Response and Isolation (ETDRI) is
URL Protection, which helps
a cloud-based service that uncovers and prioritizes advanced attacks
provide the strongest protection
entering your organization through email by adding advanced detection
against spear phishing, targeted
technologies such as cloud-based sandboxing, Click-Time URL Protection,
attacks, and other advanced
threats.
and Web Browser Isolation to the Symantec Email Security.cloud service.
In addition, it helps accelerate your response to targeted and advanced
• Accelerate response to targeted threats with advanced email security analytics that provide the deepest
and advanced attacks through visibility into targeted and advanced attack campaigns. This intelligence
advanced email security analytics
includes insights into both clean and malicious emails as well as more
that provide the deepest visibility
Indicators of Compromise (IOCs) than any other vendor, with more than 60
into email attack campaigns with
data points such as URLs, file hashes, and targeted attack information.
more than 60 data points on every
clean and malicious email. You can export this data to your Security Operations Center (SOC) to
• Quickly correlate and respond to quickly determine the severity and scope of any targeted or advanced
threats by exporting advanced attack. Furthermore, you can quickly remediate email attacks by
email security analytics to your automatically blacklisting IOCs found while hunting threats. Moreover,
Security Operations Center ETDRI reduces the risk of phishing by preparing your users to recognize
through integration with third- the latest phishing attacks with built-in security awareness training. Finally,
party SIEMs and Symantec when used alongside the Symantec Endpoint Security and Symantec
Information Centric Analytics (ICA). Web Protection family to detect advanced threats, you can automatically
• Decrease remediation time while correlate events across all control points.
preventing newly discovered
threats with automatic blacklisting
Cloud-Based Sandboxing
of IOCs found in your security
environment. ETDRI customers can leverage cloud-based sandboxing capabilities to
discover and prioritize today’s most complex targeted and advanced
• Reduce the risk of phishing with
attacks. This service uses advanced machine learning, network traffic
security awareness training that
analysis, and behavior analysis to detect even the most stealthy and
prepares your users for phishing
attacks and helps you prioritize
persistent threats. In addition, it’s infused with security telemetry from
protection for the most vulnerable the Symantec Global Intelligence Network, the world’s largest civilian
users in your organization. threat intelligence network. The Symantec Global Intelligence Network
provides comprehensive visibility into the threat landscape and delivers
• Correlate suspicious activity across
better security outcomes by collecting and analyzing security telemetry
all control points to identify and
from more than 175 million endpoints, 80 million web proxy users, and
prioritize security events that pose
8 billion daily security requests across 157 countries. Our cloud-based
the most risk.
sandboxing also provides you the details of malicious files and their
execution actions, so that all relevant attack components can be quickly
investigated and remediated. Today, many advanced attacks are virtual
machine-aware, which means they don’t reveal suspicious behavior when
run in typical sandboxing systems. To combat this, we employ techniques
to mimic human behavior and execute suspicious files both virtually and on
physical hardware to uncover attacks that evade detection by traditional
sandboxing technologies.

Email Threat Detection Response and Isolation

 Product Brief

Click-Time URL Protection Advanced Email Security Analytics

Click-Time URL Protection blocks malicious links by ETDRI helps accelerate your response to targeted
analyzing them when they are clicked by end-users to and advanced threats with advanced email security
protect against spear phishing attacks that weaponize a analytics that provide the deepest visibility into email
link after an email is delivered. This complements Real- attack campaigns. This rich intelligence includes
Time Link Following technology in Email Security.cloud, detailed reporting on every clean and malicious email
which blocks malicious links used in spear phishing entering your organization. These reports include
attacks before an email is delivered. Unlike other more than 60 data points including IOCs such as the
solutions that rely on reactive blacklists or signatures source URLs of an attack, targeted attack information,
to stop spear phishing attacks, we proactively stop malware categorization, sender and recipient
both new and known spear phishing attacks that information, method of detection, clicked re-written
employ malicious links by performing deep evaluation URLs, and detailed information about file hashes. Each
of links in real-time. This deep evaluation follows links attack is assigned a threat category, such as Trojan
to their final destination, even when attackers use or Infostealer, and a severity level of low, medium, or
sophisticated techniques such as multiple redirects, high to indicate the level of sophistication of an attack.
shortened URLs, hijacked URLs, and time-based delays You can even search and find detailed information
that bypass detection by traditional security solutions. about blocked emails, including both the original link
Any files found at the destination URL are downloaded in an email and the final destination link containing
and deep heuristic analysis is performed to determine malware as determined by Real-Time Link Following.
whether they are malware. This deep link evaluation These advanced analytics give comprehensive insights
powers both Click-Time URL Protection and Real-Time into targeted and advanced threats against your
Link Following, which enables us to provide the most organization by offering more IOCs than any other
effective protection against spear phishing, targeted email vendor.
attacks, and other advanced threats that contain
malicious links.

Figure 1: Block Malicious Links with Click-Time URL Protection Figure 2: Deep Visibility into Email Attack Campaigns with
Email Threat Detection and Response

Symantec Cloud Email Security

File IPs & Sender & Severity Threat Malware Network
Hashes URLs Recipients Level Content Behavior Callbacks

Advanced Email Security Analytics

Real-time Link Following Links are re-written
blocks malicious links
before email delivery Extensible Email Phishing Service
APIs for investigation Combine phishing protection
and containment with phishing assesments
End-user clicks link

SIEM/SOAR

Safe links proceed to Click-time URL Protection EDR ICA Phishing Phishing
final destination blocks malicious links Detection Awareness
when they are clicked

Email Threat Detection Response and Isolation

 Product Brief

Security Operations Center Integration Automated Remediation

ETDRI enables you to easily export the advanced email Security teams frequently come across IOCs when
security analytics on clean and malicious emails to responding to an attack or while correlating and
your SOC through integration with third-party SIEMs hunting threats in your environment. However,
such as Splunk, IBM QRadar, HPE ArcSight, and more. remediation is often slow and cumbersome even after
Threat intelligence data is streamed directly to your these threats are discovered since IOCs are typically
SIEM through a granular, API-driven feed to give your blacklisted manually. This manual process delays
security team rapid visibility into threats. Security response time and increases remediation workloads,
analysts can leverage this data to quickly correlate and which can be critical for security teams dealing with
analyze threats when investigating and responding hundreds or even thousands of incidents at a time.
to threats. You can easily respond to email threats
with a free Splunk or IBM QRadar app, which allows ETDRI allows you to quickly respond to targeted and
you to export the advanced email security analytics advanced attacks by automatically remediating email
directly to Splunk or QRadar. These apps provide deep threats. These capabilities speed incident response
visibility into the threat landscape with data points such by automatically blacklisting IOCs such as file hashes,
as malicious URLs and file hashes, information such IP addresses, and sender and recipient information
as high-risk users, a geographical view of incoming through an API. Furthermore, security teams can
attacks, and a timeline of email malware. blacklist threats through the admin console. Blacklisting
these IOCs protects your organization from newly
You can speed-up detection and response of targeted discovered threats, decreases the time to remediate
and advanced threats by exporting our advanced email attacks, and improves your overall security posture
security analytics to ICA. ICA helps you understand and while increasing the productivity of your security team.
prioritize the riskiest threats to your organization by In case any threats get through our defenses, ETDRI
correlating email analytics with broader security and automatically removes these emails from Office 365
user behavior analytics. inboxes before your users can open them.

Figure 3: Symantec Security Operations Center Integration

Advanced Email Security Analytics Correlation & Response Customer IOCs Benefits

Identify targeted
SIEM attack recipients

SOAR
File Hashes URL Automatically
Attack Information
Email Malicious Email block IOCs
Technology
Volume Theme or Topic
Used

Prioritize against the

Malicious Attachment highest risk threats
Export Email Senders File Type
Intelligence
Symantec EDR
Severity File URL Correlate threats
Level Hashes Information Blacklist Threats with endpoints

Newly Detected
Feed URLs into
Threat Patterns
Symantec ICA web proxy

Malicious Email
Malware Detection Find patterns
Senders &
Category Method in threats
Recipients

Symantec ICDx Symantec.cloud Monitor

60+ Data Points, Clean and Blocked Emails email logs

Email Threat Detection Response and Isolation

 Product Brief

Email Threat Isolation Security Awareness Training

Email Threat Isolation shields users from advanced ETDRI includes security awareness training, which
email attacks such as spear phishing, credential theft, reduces the risk of phishing by evaluating user
and ransomware by isolating suspicious links and readiness to phishing threats while helping you identify
attachments while stopping credential theft by safely and train the most vulnerable users in your organization
rendering risky web pages: on phishing attacks. Customizable security assessments
enable you to assess user readiness to phishing attacks
• Prevent spear phishing attacks by isolating by simulating the latest real-world phishing threats
malicious links and downloads: Email Threat Isolation across your organization. After simulating an attack,
takes prevention up a notch by creating an insulated detailed reporting and executive dashboards help
execution environment between users and their you benchmark employee readiness and pinpoint
email links. Suspicious links are rendered remotely, the most susceptible users. Finally, you can improve
users are shown only inoculated web content, and user readiness to phishing threats by using training
potentially infected downloads are scanned before notifications to educate users on new and emerging
delivery. Attacks meant to be delivered via malicious phishing attacks and performing repeat assessments to
links are therefore neutralized. track readiness over time.
• Stop credential theft and phishing attacks and by
safely rendering web pages in read-only mode: Consolidated View Across Control
When a suspected phishing website is opened
via an email link, the site is rendered in read-only
Points
mode, which prevents users from entering sensitive ETDRI integrates with Endpoint Detection and
information such as corporate passwords. Response and works alongside the Secure Web
Gateway family to detect advanced threats that evade
• Prevent ransomware and other malware from
individual point products. This is powered by the
infecting users by isolating email attachments:
massive Symantec Global Intelligence Network, and
Advanced attacks that use attachments which link
includes the ability to automatically correlate threats
to ransomware and other malware are stopped from
across all control points through Endpoint Detection
infecting users by isolating email attachments. When
and Response.
a potentially risky attachment is found, email threat
isolation capabilities render these documents in a
secure remote environment, which creates a virtual
‘air gap’ between files and user devices. As a result,
ransomware and other advanced attacks that hide
malware in email attachments cannot infect users.

For more information, visit our website at: www.broadcom.com

Copyright © 2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. All
trademarks, trade names, service marks, and logos referenced herein belong to their respective companies.
SED-ETDR-PB101 December 21, 2023