Configure Advanced Settings
After configuring basic settings for a threat mailbox, you can proceed to configure a few advanced settings, such as the allowed emails, intel creation preferences, and folder synchronization while adding a Threat Mailbox account. However, you can also configure these settings after you successfully add an account.
To configure the advanced settings after adding an account, do the following:
In the Threat Mailbox, click the ellipsis on the top right corner of the screen.
Select Advanced Settings.
To approve a set of email addresses to receive emails from, select Allowed Emails and enter the email addresses and click Save.
To configure intel creation preferences and regulatory email preferences for emails received from senders using this setting, select Intel Creation Preferences.
To assign default metadata (such as TLP, confidence score, and more) to report objects, select Assign Default Metadata to Report and provide the following information:
TLP: Select a default TLP to be assigned to the report.
Confidence Score: Set a default confidence score to be assigned to the report.
Deprecates after: Set the duration in days after which the threat data (indicator) will be deprecated, unless the source provides an expiry duration (Range: 1–180 days). If the same indicator is received from multiple sources, the longest valid duration is applied.
Custom Scores: Set the default values for custom scores to be assigned to the report.
Tags: To identify and categorize the account, add tags.
To assign the metadata to all objects associated with the report object, select Apply Default Metadata to all objects. If not selected, metadata is assigned only to the report object.
To automatically create intel for all emails received in a specific Threat Mailbox account, select Create Intel from all received emails. You can also choose to include attachments and IOCs in the intel. You can view the created intel as a report in Threat Data.
Note
To enable automatic intel creation, ensure that the required folders in your mailbox have synchronization enabled. For example, enabling synchronization for the All Mail folder creates intel for all received emails. To enable synchronization, see step 5.
To differentiate emails from a specific source under a category for focused consideration, select Mark all received Emails as Regulatory Emails.
To include attachments as artifacts and include IOCs from attachments for specified emails, go to Filter by Specific Email(s).
Click Save.
To segregate mails in various folders based on their importance, select Folder Synchronization, and choose the folders to appear in your threat mailbox account.
You can choose which folder they want to sync and manage intel creation preferences for emails received in a folder.
Click Save.
Note
The settings configured here apply only to the selected threat mailbox account.