How to Specify Attack Response Options

Specify what happens when a new advanced threat or account takeover attack is detected. You can change this information at any time. Making changes does not affect suspicious emails that have already been found and remediated.

Advanced Attack Responses

To specify responses to advanced attacks:

1. Click the Settings icon  to access the administrative functions.

2. Select the Email threats tab.

3. Choose the action you want to take when you find a potential advanced attack:

   • Send to junk/spam (recommended) – The email is moved to the recipient’s Junk or Spam folder. The recipient can see that the email has been flagged as suspicious and can determine if the email is valid.

   • Delete – The email is permanently deleted from the recipient’s account. If you delete the suspicious email, it cannot do damage. However, the recipient will not be able to see the email to determine if it is valid.

   • Leave in inbox – The email remains in the recipient’s inbox. Impersonation Protection does not take action, but tracks and reports. This puts Impersonation Protection in Reporting Mode.
     Note: Selecting this option will disable automatic remediation in Barracuda Incident Response.

4. Specify whether you want to send an alert to recipients affected by the suspicious email. Click Customize Alert to personalize the email for your organization.

5. Specify whether you want to send an alert to your security team when an attack is detected. Specify the email address that will receive the email alert. If you choose, you can specify a single email that acts as a distribution list to notify several individual administrators. 

6. Click Save.

Account Takeover Attack Responses

To specify responses to account takeover attacks:

1. Click the Settings icon  to access the administrative functions.

2. Select the Account Takeover tab.

3. Specify whether you want to send an alert to your security team when an account takeover attack is detected. Specify the email address that will receive the email alert. If you choose, you can specify a single email that acts as a distribution list to notify several individual administrators. 

4. Click Save.