Beyond the Gateway: Level Up Your Email Security with ETD Inline

Good morning, good afternoon. So I'm Srini, so let me.00:10Share the presentation of today's session ok so I think hope you're able to see my screen and you can be able to hear my voice clearly.00:18Okay, thank you for letting know. So in today's session, we are going to see the Cisco email threat defense solution. So how it's organized the email security.00:35And how the SaaS solutions helps the customers acts like inland different solutions to protect the emails that is comes inside to the organizations as well as within the organizations. So that's why this is ETD as a inlane defense flow.00:51So in today's session, myself and my colleagues Kanan Zenith and Katepin are going to do the presentation and demo on today's session. And myself and Kanan will do the presentation and can will do the.01:12Demo session of today ETV session. So before we start the presentation, let me cover a few logistical items. So during today's sessions, you will have the opportunity to ask any questions you might have about.01:31Today today expected serious and just to type the questions by using the slide option, you have the slider application at the bottom. So if you click that application, you have the Q and A option, so click on that and you can type your question.01:50And our our team maybe any one of from three of us will answer those questions which you put on those Q and A panel.02:06Okay, let's get deep into the today's expected six video session. So today what we are going to see means how ETD is going to act like a inline different solution, inline email different solutions.02:21And what output you can expect from the solution. So that is, that is the objective of today's session. So 1st in just to segregate three topics, 1st we are going to see what is the email thread landscape.02:39For last three decades and how the different solutions has been updated in for the last three decades. 2nd one is we are more focused on the ETD. We are focusing what are the different types of architectures available in human thread defense.02:56And also what are the detection engine to identify the latest pattern based email attacks and how the ETD get intelligence for finding those attacks. So what are the intelligence sources?03:13The next one we are going to see the different deployment modes and what are the operational controls or the business outcomes you will get from the ETD solution. So these are the.03:29Three segregation topics we are going to see on today's session. Okay, if we go back to early 2000, the email thread problem was largely driven by the volume.03:44So organizations dealt with most viruses and links to infected websites. So defense is more focused on the reputation of the IPs, antivirus solutions.03:59Identifying the authentication of the sender by using the SPRF mechanisms as well as the legacy type of we have used to find this volume based attacks.04:16This is part of 2010 2002 2010. And the next decade, 2010 to 2020 as organizations we have received more phishing business compromised emails and user impersonations emails. These are the more common.04:31So to identify those setup, we not only needed legacy type solutions, we needed multi multiple engines should answer, so we are using URL planning, dynamic file analysis, answering language processing. So these are the signal aggregation, so.04:47Which I mentioned here, so these are the methods we are used to identify those type of ransomware and reception based attacks. Now, from 2020 to 2026, if you have checked the FPA or as well as the intelligence reports from India as well as yours, you can.05:07Able to see there are more type of attacks are created based on the age generated emails and there are also Q based attacks, image based attacks and HTML, so these are the common email attacks that is happening on this decade, this.05:27So to identify those attacks which is a very latest, you should have a intelligence which can be able to identify those latest trends and able to fix those. So we are using the optical character recognition CLLM.05:45Modeling, so these are the latest different mechanisms we are using now. So this is how the email thread landscape has much improved or last solutions also improve. Now let's come to the.06:00Email part. So why the email security is evolving? So the traditional secure email gateway remains valuable. So especially for controlling inbound or outbound way at the perimeter. However, whenever the email itself had changed many organizations now use.06:16Cloud hosted platform hybrid environment shared mailboxes, internal collaborations workflow. So a perimeter control generally sees the message that crosses the perimeter. That means at the gateway can be able to see inbound and outbound.06:33It's not having the complete visibility within the organizations, between the mailboxes or within the organization. So there's a chance of compromise. So that's created a visibility cap because an attacker uses a compromised mailboxes.06:50They appear to be a trusted internal centers. So that's why the ETD uses several options like channeling APA based integrations and inland productions. So this inland productions adds another option. It allows the platform to evaluate the message and enforce the policy.07:07Before mailbox has been delivered because in generaling mode, the actions will be taken post delivery. Post delivery then 4 s back it will take to remove the mail if it is a malicious one. But in inline mode.07:24The processing or the checking of the or the scanning of the email happens before you deliver to the mailboxes. So that is the benefit of EDD in. Okay, Cisco EDD.07:40Provides the established gateway capabilities, ok? So it includes the cloud integrated email security expanse visibility and brings cloud based analysis closer to platform such as Microsoft 3605.07:58So ETD brings this capability into your unified platform designed to operate at a cloud scale. There are three ideas. One is the unifications and another is the scale and another one is the simplified management.08:14So these are the main benefits. So unified means oh we can say that you have don't need to move, you don't need to move through multiple dashboards. You have a single dashboard where you can able to see multiple informations like a message.08:29Investigated care campaign and you can also take actions. 2nd one is means every messages can provide multiple signals. So like sender reputations, authentications, language, what type of image.08:46What is the URL score attachments recipient relationship, user behavior. So these are multiple signals. So it uses the A and the ML based techniques using those signals and it will take out the dishes by using the data sets.09:01Okay, and also the simplification of management. So the advanced directions is valuable only if the security team or the network team can deploy it and understand the and search the data and take the actions effectively.09:17In a very less span of time. So that is called simplified management. So the ETD is also a simplifying management solution. So let me go much deeper on three things for ETD one is the architecture.09:33And what is the enrichment and what are the enablement options of ETD? So in the architecture ETD uses the public cloud services. It provides foundations for processing the messages and observables at scale. And the designs also consider privacy controlled access.09:50And data confluence confidentiality based on the geopolitical complaints policies and regulations. And the enrichment is more focused on how messages follows the digital, that is the thing. So it applies natural language processing and it extracts the observables.10:08And it will refers the global intelligence and it will evaluate this sender recipient relationship through the user graph and it can able to call the URL and it can also perform static as well as the dynamic analysis when recorded. So this makes the ETD solutions much enrichment.10:28And compared to the legacy and and then enablement. So in the enablement layer, we just the intelligence into your operational capability. We processed informations and observants are indexed, so analysis can search them.10:48And policies can enforce actions and AP supports rapid queries and foreign sending workflows. So the integrations can share intelligence with systems such as Cisco XDR or or other security platforms. Okay.11:04So there are two ways to deploy ETD, one by you so we can say based on the license one is the essential and another one is the advantage. These are the two types of licenses. This license is having two different types of deployments. Let's see that.11:21So the essentials is more, it's like a post delivery actions. That means here the email will come to the mailbox 1st, then by using the API method or the the copy of the email will send to the EDD.11:36Then the ETD will process the email and it will send out the to the outlook, outlook mailbox by using the API and then the Outlook mailbox will act on those emails accordingly. It will access a post delivery actions one because the mail.11:54Will be delivered to the users and within four to maximum meetings within that second it will remove the mail if it's a malicious. That is the use of the supplement productions essentials. Then gateway productions which is the inline which we are seeing now. So here between the internet.12:12To the mail server, the ETD gateway will be there. So it's like acts like a mail firewall, it acts like a mail firewall, email firewall, we can say. So it will act, it will block the it will process before the mailbox, so pre delivery blocking can be done.12:31So the previous one supports the but this gateway solutions can be able to support O 3605 Google workspace, Microsoft Exchange or any other mail transfer agent or any other on prem.12:49Because here only it will add the tagging. So once the tag like spam malicious or external tag will be added, it will send to the destination, it will send to the mailbox. Yes, it will support the TLS versions.13:04Maybe TLS to connect with your mailbox for a secure encrypted connections between the ETD solutions to your mailbox. And you can also be able to integrate with the secure access for the DLP.13:20For any outbound emails to loss of data to prevent the loss of data and also you can be able to connect control the connections based on the IP as well as the domains and SMTP control is also possible.13:36Now, now we can look more on the EDD line architecture. So different types of thank you so one is 1st one we are able to see here, let me take on the pointer 1st.13:54Here the email comes and 1st to the email will reach to the Cisco EDD because the mxs will be the global MX will be pointing to the EDD solution. So from the internet, any email mail will come directly to the MX pointed EDD.14:12Then the ETD will process the email as like in a firewall, then it will deliver to the mailbox, maybe server, maybe it's a spam or a malicious or.14:27It will add in this and it will send to that. Then understood that whether if it's a clean email it will deliver to the end users or otherwise it will drop the email or it will put into the quarantine mailbox. Suppose if the user A has sent the email to user B within the organizations.14:43Then that internal emails will send the using a graph API and it will send the what action has to do via API, ok? This is one method. The next one is pointing to the ETD, but we are having Cisco security email get pay solution also.15:02So here, yeah, the 1st one, the process the email is ctdd. Then it will deliver to the email security with the tag, then it will process the email, then it will finally transfers the double secured email to the mailbox and the mailbox again the internet email information to ETD then it will process, then it will send.15:22To the API call via gateway to the.15:43So the here just to add the gateway solution. The next one is the gateway will access a email security cloud gateway will access a perimeter email perimeter firewall. So the MX will be pointed to here. The traffic will be processed to the gateway, then it will land out to ETD.15:46Then the ETD will process those emails, which is sent by the ETD as a clean one which will process.16:06Then it will send along with the tagging to the mailbox and the mailbox again sending the general information about the internal email, then it will send out the ATD replay for the internal emails. So here the MX pointing to the email gateway. The next one is the loopy mode.16:12So the mode is mostly designed for 3605 ETD and email security like this one. So that is called loopy mode so so the describes the shape of the flow, but.16:29We should be very clear and intentional routing loop is not the same as the uncontrolled mail. So each app must have a specific purpose and design must include conditions that prevent repeated processing. So this model can help customers preserving existing gateway service.16:49While inserting ETD into the message part for additional analysis and policy enforcement. So it can be useful in migrations or coexisting scenarios, but the customers cannot immediately redesign the entire mainly architecture.17:06So from a technical perspective, the connector configurations message, op identifications, trusted IP range and routing conditions are critical. So the testing should cover normal mail policy triggering email.17:21Fail handling and message that internally, so all has to be done testing then only it comes to the production environment. Okay, so supports not only it will support the non O 3605 also.17:37So how it will be sender 1st is delivers the message to the ETD, then the ETD analyzes the original message including the header content, URL files, authentication results and behavioral context also.17:56When ETD determines a message is a thread or a spam, it can add appropriate header, then it is then such as Microsoft 3605 workspace or main server.18:11Okay, the receiving mail server uses center as an enforcement signal, a downstream downstream mail flow can move the message to the quarantine and placed into a specific folder and block delivery or or it can also apply another conditions also.18:26The distincts between the original letter and another additional ETD header is important. Original letter preserves mail trace and sender context, and ETD header communicate ETD header will communicate whether the analyst results so.18:43The downstream system can take the a clean or malicious email. So that is the important thing. So this is the ETD defense how its architectures looks like. So here it uses the Talos as a global.18:58The message intake there are three methods. One is via using the inline mode which we are discussing and another one is the general general mode which we can able to solve for the internal emails and another using the ET email security characters directly connecting the ETD with the email security solution.19:20If if it's they are not in inlane mode and also they're not using and the content once done that the content extension engine will extend the contents of URLs, attachments, body content, image metadata.19:36Then it will send so it will send to the engine and it will pass and evaluate those. It will send to multiple things like user graph and behavior modeling. It's completely driven and then it will send to the legacy global intelligence like IP spam, domain check, AV check, and maturity check.19:52And it also if any file attachment then it will send for the dynamic analysis using secure malware analytics and URL planning, and it also uses A detection capability to find out the to find out any A based attacks using the LLM technique.20:11And also it uses the NLP, ok? Natural language processing to identify any any attacks present on those emails by using the A driven mechanisms. Then you can be able to see the dashboard the observables and metrics.20:28Similarly then text to brand abuse duely center, all those you can be able to see, ok? And what are the actionable means policy you can create allow block or tagging and user experience is very fast and initiated and flexible.20:46And the API by your API you can able to search the message and you can remediate and log export and you can able to integrate with the and you can also able to take the retrospective actions. So the API is the most.21:01Important because security operations cannot dependently on manual process, which is time consuming, so nowadays we are not doing much manual, we are more automating your.21:22The 1st step is authenticating mechanisms in the AP. So an applications must authenticate securely before it can query EDD or performance in action. Then the message that JP enables the customers to search using filters such as senders time and other message attribute.21:34This can support threading case investigations or automated correlations with an alert from other system. Then the reclassifications and remediations. So AAPI supports actions if an analyst or an automated workflow determines that a message needs a different mailbox locations.21:53The AP can initiate the change, ok? Then status you can understand the result of remediations and reclassifications by using the status option. And also we are having the reporting options. So you can able to get the consolidated reports of how the ETD performance for last one month.22:12Without the three months specifically for 30 days at a time to get a consolidated report of impact what it what is the outcome we can able to see in the reporting option. And there are three types of logs present in the GDD one is the audit log message event log.22:32As well as the connection log. So audit log get the informations about the logging actions, changes in the ETD and message event logs get the informations about the complete messages and any events like retro manual classifications and connection logs will give the complete list of connections IP and the.22:51Domain informations of the ETD inlane mode. So that is the connection. So when you take inlane mode as well as the general mode, you both having audit as well as the message event log. This connection lock is added only on the ETD mode, which look on the IP level.23:11Source IP checking also. Okay, thank you. So let so I I completed the 1st half of the session. So the next top of the sessions will taken care by my colleague Kanan, so I will hand over the next slide thank you for walking us through the foundation architecture of ETD.23:31We have seen now how ETD connects into a mail flow. Let us look at how modern threads actually look like and how ETD applies multi layer AI sandboxing and behavior modeling to utilize them. Take this 1st example picture in here. At a glance, this looks like a completely normal alert from Charles.23:51It greets the user by name, talks about account balances and create a sense of urgency. But under the hood, this sender domain is brand new and has never emailed this recipient before. Traditional tools usually miss this because the domain is, isn't on any block list yet, but ETD catches that identity mismatch immediately and can action on it.24:11Now here is another class, another classic scenario that is business email compromise. If you look this email sample picture, you can see that there are NO malicious attachments and NO viruses in here. The attacker is just using social engineering and financial topics to get the user to pick up personalized link.24:34There are NO bad file hashes as well. Legacy gateways might think this is clean. ETD looks at the urgent tone, the unusual sender, and the topics to stop the struggling email. Now here is another example. This happens all the time. Attackers pin up a free Gmail or Outlook account using a CEOs action.24:52To display name and send a quick note like hey, are you at your desk text me or give me a let me have the mobile number so I can reach out to you or something of that sort. They just want to start a quick chat before asking for gift cards or immediately supports certain inter.25:12Internal executives name is coming from a random external email addresses and cut the attack attack off right away. So how do we tackle all of these threats? We still use classic gateway defenses like IP black, like IP blacklist SPF BKIM.25:28Those are great for knocking out millions of bulk spam emails at the front door. But in this AI era, we have more sophisticated attacks like AI generated phishing, weaponized QR codes and targeted BEC attacks. That's where's natural language models and computer vision comes in. It gives you deeper production with.25:50Not slowing down mail delivery.26:08Now behind all of this is our Cisco Talos. Every single message is backed by real time global Threat Intel. Talos sees hundreds of billions of emails every day. 2nd and attacker infrastructure pops up anywhere in the world. Your gateway knows, knows about it and blocks it within minutes.26:12Now one of the one of the one of the question that was raised in chat is regarding the OCR detection, so this slide that I'm gonna discuss about is about that. So one trend we are seeing a lot lee, lot of greatly is image only phishing. Attackers.26:30Place scanners look at the text in the mail body, so they started putting the India phishing message of fake invoices inside the picture. EGDD handles this with built in OCR. We pull the text right after the image and feed it directly into our language models or inspection.26:50Now one thing, one challenge is that running OCR or every single image would naturally cause delays. So we use smart virtual heuristics 1st. The system can instantly tell the difference between a harmless logo or a photo versus a text heavy frugal and layout. We only send the suspicious images to deep OCR, keeping a mail flow floating.27:07Thank you click.27:27Moving on to how we handle files entering our organization, let's talk about the file analysis feature within ETD. This is really one of the core defensive layers. Our ETD platform integrates with our secure malware analytics platform for for file file inspection and analysis. Our SMA supports our.27:31Almost all types of file types are ranging from office documents, PDFs to scripts, archives and executables. Our static checks filter out over 90 % of the safe files in milliseconds. So we can save full sandbox detention to for truly unknown potential zero day attacks.27:51Now let's have a look at the static analysis feature within SME. We effectively combat modern threats, we begin with a rigorous static analysis to classify files before they even execute. By leveraging trusted databases like NSRL and Talos along deep inspection techniques like magic ID and string extraction, we can instantly.28:08Identify malicious patterns such as credential theft or dropper malware, which are mostly hidden within the common file types. This automated process doesn't just flat threads. It intelligently maps each file type to the optimal virtual machine environment for safe dynamic analysis. Ultimately, this layered approach ensures we catch sophisticated attacks early while.28:29Minimizing false positives through robust allow listing.28:48Most of the files we see can be addressed quickly using static analysis. These are the files with known signatures, the known that, where we already have a record of their hash values. But the real challenge for any security team is dealing with the unknown. Those unique never before seen files that doesn't match any database. For those.28:54Cases we move into dynamic analysis.29:13To effectively combat modern threads or and potential zero day attacks. We utilize a sophisticated four stage dynamic analysis pipeline. We begin by execut exec executing suspicious files within a custom engineered hypervisor designed to bypass evisions techniques and this ensures that we capture the malware's two behavior.29:15During execution, we collect comprehensive telemetry ranging from memory dumps and APA locks to pull packet captures. This provides us with a complete picture of that threat. Finally, our expert system synthesizes this data, applies multi engine analysis and behavior in behavioral indicators to calculate an accurate threat score. This rigorous process allo.29:35Use us to move beyond symbol detection and gain actionable intelligence on even the most evasive attacks that is happening right now.29:55Now let's look at how ETD pulls all these puzzle pieces together using data science and behavioral modeling each email is checked for a variety of independent signals. The key takeaway here is that NO single factor makes sens.30:06Call whether an email is malicious or not. Every email has a dozens of signals that is sender reputation, domain age, language stone link targets, and recipient history. ETD looks at all of them at once.30:26Our machine learning models, take all of those weak or subtle indicators and weigh them together. Even if an email looks harmless in isolation, when multiple anomalies lines up, the model recognizes the attack pattern and makes the right call either to block or quarantine or move it to a junk folder or.30:43Now we break down detection, we break down the detection into two things content and context. Content is what is inside the message such as the words, links and attachment. Context is the relationship who normally talks to whom their roles and their communication habits.31:03Now, one thing is that content alone is not enough in this model. We, we do need a context as well. Now, why do we need both? If an attacker sends a clean email saying, hey, please text me the financial report or as a, as an example in the picture that we're seeing here, let me know when you're occupied. I'll need to get something done. A basic scanner seems.31:21The English, the zero, there are zero links zero viruses and let it pass through. Content scanning alone is blind to relationship based attacks.31:41This is why ETD builds a continuous mail graph. It maps out communication patterns across your company to understand who your VIPs are and who people talk to regularly. When someone brand new tries to contact an executive with an urgent tone, the mail graph immediately flags a relationship.31:51Ship anomaly.32:11At the same time, we know that your e your team gets plenty of legitimate emails from new people every day, like new customers or vendors. If you block solely on new senders, you'll get flooded with false allowance. High accuracy happens when you come in an unfamiliar relationship with high risk content intent.32:14This behavioral approach gives you three team three big advantages. The 1st is that it's evolutive. It catches new variations in an attacker phrase automatically without needing manual rules. It's interpretable. It tells your analyst exactly why an email was flat. Now if you see this picture over here, you can see that a specific email has been flat as phishing.32:34And what characteristics such as low content reputation, request for contact details, right? What characteristics person in that email has led to that led to that verdict. So that kind of interpretable information is available within ETD. And the last thing is that it's actionable. It clearly labels the risk, whether it's credential theft or wire fraud so you.32:54The team can triage it quickly.33:14Now to wrap things up, ETD features a continuous closed loop learning model. Whenever administrators review and classify emails, that real world feedback trains the model on your company's specific culture and vendor relationships. This means ETD gets smarter and more resilient every single day.33:18Now that we have covered the underlying architecture, the AI detection engines and behavioral modeling, let's see all of this in action. I'll hand over to my colleague Ketwin who will walk us through a live lab demo to show how ETD catches these modern threats in real time. Over to you Catwin.33:46Sure, Thanks. All right, everyone. So what I'm going to do, I'm going to run you through a really quick demo and then let you see how defense or ETD.34:01Work in kind of like a live live demo and I'm trying to send some real traffic as well, right? I will start by showing you the ETD dashboard, right? And then some of the messages, I mean as an administrator, how do you interact and then.34:16Most likely what are the action that you might want to do on a day to day basis, right? Then I'll move on to the configuration perspective that I will show you. I mean because we have been talking about ETD in line, right? We talk about the advantage mode, I mean the SMTP. So how does the setup works, right?34:36Yeah, and then also to emphasize or to re answer some of the question that was asked asked earlier like.34:56Whether you work with Google workspace. I mean I'll I'll just show you. Once I show you you get a better idea, right? And then I'll move on to something live and then I'll show you something like a real email and then things like some header and then some view of that. Yeah, let's let's look at that. What you're seeing right here.35:04This is what you will see when you log on to the email threat defense, the ETB, right? This is the 1st page, the dashboard. Top corner here you see the threats and then some categories, BC scan fishing, malicious, some of the categories that Kanan has mentioned as well, right? So this pretty much is.35:24The security threats that ETD has been detecting or maybe put it in another in other words, this is how your organization is being targeted, right? So this means from email perspective, this threat is trying to hit your email box and then this is how ETD trying.35:43To protect and.36:03Detect all these traps and then take an action based on the configuration and policy that you configure, yeah. And then on the right here you see some unwanted email like spam, like gray meal. Technically it's not really traps, but then it's something that you do not want your user to spend time.36:06Reading or even deal with that. I mean, you do not want to affect your user productivity, you do not want them to even look at all this thing, yeah. So this is how EDD can handle for you. I mean, it's really like a typical SMTP or like an email security can do to stop the track, to stop unwanted email. Moving now we.36:26We have the message messages scan, I mean the trend, how was the email traffic like and then we can drill down to that day to week. And moving now further, we have this internal senders. This is something.36:45Interesting, and this is something that the administrator might need to spend time looking in because that will be flat whenever we see some of your internal email user or maybe internal mailbox. E.g., maybe they're sending like a lateral.37:02Example maybe user A sent to user B within the same domain, right? This, this is alerting because that means that is inside the alert. And then it could be a signal that you might want to spend time looking to all this user and then see whether.37:19Is their machine being compromised and then it's really worth the effort to spend time investigate further. Yeah. This also apply to if let's say the internal user is sending some outbound email and then it was caught by ETD.37:37Yeah, so if both internal and outbound and the bottom right here we have this quick message filters, the 1st one retrospective. This pretty much is the same thing that kind of mentioned, the file analysis, if there was the unknown file and then it changed wording after the delivery.37:53We are tracking all of that and then that is what we call the retrospective events, right? And then that will be flat. If I click on this link here and then it will just bring me down to the 1010.38:12Violation, and then we have more thing here like how many email in quarantine and then some policy perspective. So moving on next, let's on to the messages. Messages is where your user or your security administrator spend most of their time in, right?38:28Top panel here, you see the similar thing, the threads, the messages, how many email, incoming, how many outgoing internal as well, and the trend and comparison, right? And then, in the middle here, so this is pretty much the main.38:47Viewing glass that your administrator will spend time looking into, right? So because this is where you flag and show all of your email, right? So that's when the email with the data like when was the timestamp, timestamp, the receive timestamp.39:05Sender recipient, subject information, the direction of it, the verdict of the email, the action as well, right? So even the email without verding, it will be shown here as well, right? So here will allow your administrator to really quickly jump into the email and then take action if needed, right? I'm just going to.39:20Start with one of the example here. Let's, let's try 2nd email here showing the scam, so let's look at it.39:40I'm just going to put anywhere between this line and it will bring me down to that email. Alright, so let's see. 1st thing 1st is the timeline. The timeline shows that multiple events or stages this email has gone through.39:48The moment it passed through ETD, right? So trumper.40:08Will received during this timestamp and then SPF, pretty much like the earlier SNTP function or like the email firewall Thatson has mentioned earlier, right? So I have somebody here, most of the SPM team demark.40:11Australia, right? And then we gave it a bad wording, right? Based on this policy, it was a scam, right? And then the action taken delivered to John, so based on my settings of my policy and then delivered to my next one. So this.40:28This is the next hope. I'll show you more on this during the configuration, right? Moving down is the verdict. As I mentioned, it was a scam because we saw it and then we are not totally just relying on content filter or regular expression, but small towards the signals or the engine behind with AI.40:45Literal language and then that's how we.41:06Classifying the wording, right? And moving down further, we have this sender information, ok? Most of days the SMTP, the from and the sender messengers and the historical trend. Like kind of mentioned, we don't just rely on content because we know we.41:10On content or the content builder is just not sufficient. So this is really like the historical that we built and then for this sender, right? And then from here we can kind of tell if the traffic behavior is, is normal.41:30And if that is abnormal, that can flag it another another as well, right? Moving down we have the recipient status, right? And then some of the additional information like if there was any links on URL within the email or attachment, right? And then from here, if needed, ok?41:46I can do my manual reclassification or manual action of this email. I'm just showing one example here. Say if I'm thinking, oh, this email is not, it's not a scam. So this this is this is neutral, right? So this could be something.42:08Something good. It was a false positive. I'm going to move this email back to inbox. Just example, you may not need to do this for every other email, but just taking this as one example. I'm going to hit on update and then notice the email action has been taken, right?42:23Very quickly, and then if we move back to my message list just now, yeah, so that was yeah remember that was 2nd line that was that was it because the verdict now is neutral. If I click on that again and then.42:41From the timeline, we will see additional few more stages, the action taken by me because I manually remediated that and I manually reclassified. You may not really need to do this a lot but then for the false positive you can do this, right? And then this also gives you.42:57A way that, just to show and then you can influence the future or subsequent way that the backend is treating or the backend AI is treating that email, right? So just think about it's just like you're giving feedback, giving input to the AI saying that, ok, I think this is this is not exactly correct.43:14Right, so then it's going to influence some of the future action and behavior, right? I'm moving on further and then say I can do the similar action in a batch, right? I mean whisper. I mean just just like what I'm showing. Yeah.43:34Example but yeah, I'm not going to do that, but just showing you this that this is possible. And then we have a really strong filtering engine here that you can pretty much show and look for whatever information that you want to. Example, if I.43:54Just choose what I did just now. I just filter for the email that I moved to inbox, right? So I can see, Yeah so that was one of the things that I did just now, right? And, I can talk about searching, I can search for keywords, right? Example I just search for anything.44:12Related to account.44:32Yeah, I have some match here. Some of this probably trying to spend yeah it wasn't, right? And the same thing notice I I can do the same thing here as well. This one I tried to search for credit card information, yeah.44:34Maybe someone is trying to spoof some critical stuff, yeah, just example, right? And then on top here, you have the way the product is showing the data. I can drill down into like a week information per month information and custom.44:53Timeline as well. For any point of time, I can go back in time for the last 90 days, so you see today's September, so I can move back to until July, right? And then at one glance I can show for the past 30 days. Yeah, maybe I can go July.45:08And then yeah that's how I can play around with the data, right? So, ok, so that's the really quick view on the messages and next I'm going to move into the configuration.45:29Okay, so since this is ETD advantage mode or ETD inline, so this, this is where it differs from the ETD establisher which was the the basic version, right? So massive source, this is where we can choose.45:48And then we can influence the different way or direction of the traffic, ok? So because we have this thing called the MS record, think about the case that Srini mentioned at the very beginning, this is one of the deployment method that.46:08How you want to pass the email through the ETD is through the MS record. That's from the MS record pointing through your domain, your or your email domain MS record, just point to EDD to this and then the email will flow into the ETD.46:25Alright, so this is for inbound, and then we, we also supporting this journal address. That's name for M 3605 cases, just add this into your M 3605 journaling rules, and then that's how we can interact with the M 3605.46:40And then, as for outbound, we have this thing called out I mean this is one example, this is this is the, this is the, just depends on our ETD pop, right? So this is for outbound and then your mail server can just point to ETD by pointing to this.46:55Outbound host name, right? Or FQDN, right? And then we will ask that for every outbound email address or every outbound email that you include this validation header simply because this is one of the way that we implement so that EDD is not being treated like an open relay. So we just want to.47:14Like kind of like validate every outbound email so that we only relay the email that is having the right validation header, yeah. And moving down here, now do forget that we have the SPF and settings. If you're sending an email.47:35To the outbound via our ETD, right? And then you want to ensure your email domain add in ETD as part of the SPF and moving down here, this is where we're putting more information on the domains. That mean this will be your domain or your customers domain.47:49Right? Just taking this one of the 1st example. So this is how the email is being set up. Let's really mentioned the email gateway mode, right? So the primary gateway. So notice from internet through the MS record pointing, it comes to ETD gateway 1st, ok? And the ETD gateway.48:09Scan and then pass on the email to the next call, which is the one I configured here. So this is this going to be your email. So be its be it a Google space. This is just the matter of a configuration, yeah. And then if I go into.48:28The configuration options, right? So I support couple of more different type of deployment example like if you have an additional gateway either in front or behind the EDD, so this is one other example. I have a secondary gateway.48:48So email passed to my additional gateway so that that's kind of in front of my ETD, and then it pass on to me ETD and the ETD pass on to the, to your email server or the other way around, I can have ETD in front and then ETD pass that email to your additional.49:05Gateway, that's your own another MTA or another email security solution, yeah. So it's just a matter of putting in the FQDN.49:25Or IP for your SMTB gateway. So, and one more thing, I touched base a little bit on this recipient validation with android ID because we do support the integration with Microsoft 3605 and entry ID. That's me we can do things like we allow.49:34ETD can go go before we allow that email, we can go in and query the intra ID to check whether the recipient email box exists before we allowing that delivery. Yeah, so that's what we we call that recipient validation, yeah. So we support that now. It's just a matter of.49:55Turning on that permission. Okay I'm moving back because I want to show you one more mode, which is a Supplemental here, the test journal, right? So this is what we call the supplemental mode or pretty much like the ETD essential or the.50:15Same version, right? So this means this is your email?50:35And then, we take in the email from the M 3605 perspective through a journaling, yeah. And then ETD is going to send instruction via API to do the action. That's mean for M 3605 perspective, we are using the API to say remove the email.50:39Move the email into quarantine or maybe just to drop some certain email. So that is.50:59The supplemental mode. And then as per the team mentioned earlier as well, because after the email has been processed by ETD, we are going to add in the custom X header and then your next hope emails SMTP or even the email server if that is not the entry find and then you can take action based on the X header. Yeah I'm going to show.51:05So shortly before that let me just show few more things before moving into that portion, yeah. Connection handling.51:25So again, because we are SMTP, right? And then, we allow you to do allow list or block lists ahead of time. That's me I want to say I allow specifically certain IP or I want to block specifically certain IP. We support settings of IP address.51:34FQDN CIV blocks as well, yeah. And then on policy perspective, I'm gonna move to another part here, obviously, yeah. So this is my life part, right?51:51Showing the policy configuration. Notice we support policy for incoming, outgoing, and internal groups as well, right? So let's look at one of the base policy. So you'll notice this is pretty much quite similar.52:06If you are familiar with CES or email security ESA, that's pretty much that similar idea. The base policy is the most important one because that kind of set the base on how we want to treat most of the violation. Example, for the security track here.52:21My base policy is to deliver to quantime, right? And the spam quantime as well, deliver, yeah. I'm an example. And then if I modify edit this policy, it looks like this. I allow you to do, I mean, allow you to set additional stuff like if I want to.52:38Modify the subject of the email, example, if that is a threat I say I want to add malicious, I want to add potentially, and then I can modify the message as well with a template, one example for spec, yeah. So this is customizable, yeah. You can do it HTML or print that.52:56That's.53:15Yeah. And then the action. The same thing possible for message modification is for outbound and the internal is slightly easier. I mean, because internal is not much that we can control from SMTP perspective, so that's very, pretty much relying on the.53:16Okay, I'm going to show you.53:36Few more life policy here. The 1st and second test junk and test quarantine. So what I did different was that for the track email, test junk rules is going to move it to jump, right? And then another test quarantine is going to move to quarantine, right? So that that was pretty much one of the two rules that I put.53:38Was it set up for this laptop. And then if I move to my messages, just showing you one of the live thing here, yeah, let's take this? Let's look at that. Yeah, so that was one testimo that I.53:58Just sent not long ago, just now when the presenter was talking, so, yeah. So that email kind of bad and then we gave it a verdict of.54:18And then the action match test young and then the action, and there's some of the verdict down here, right? And then because this is not, for this test itself, this is not an entry 65, so I deliver this email to my back end SNTP server.54:33And then it looks like this. So, yeah, that was it. This test gen, right? From here and then my SNTP server received that, ok? And then if I go down to the raw header.54:51Yeah, just open up the raw source for this email because I want to show you, how it doesn't looks like when after it was processed by EDD. Yeah, you'll notice I have this X header.55:07ETD inline process true, ok? Because it was processed by ETD. So that was the custom header that was added by ETD and then the action jumped true. So that means for my setting, I mean if that is a quarantine.55:23Okay, maybe I show another one. So that was 2nd email, pretty much similar email and then I just match it based on different policy and then this was the one that I specifically asked to quarantine, ok? Quarantine true. So what you can do as an action on remediation for your SMM.55:39Server or I mean any of the.56:00Any of the other SNTP solution you can just match for this and then just take action accordingly. I mean in a way you can still take action even without not using the M 3605 ok but again because of M 3605 if you're using that, then that action is pretty much directly integrated. But then this capability.56:02For those non entricity file and then hopefully you see the difference here.56:22So I guess that pretty much wraps up my demo and, yeah, I'm going to pass it back to Kanam. Thank you. Thank you for that excellent Demonstration. So to wrap the to wrap things up, I'd like to thank everyone for.56:28Joining us today. We are clearly operating in a new era where attackers are leveraging AI to launch sophisticated high impact campaigns at a lower cost than ever before. This is exactly why Cisco ETD was built the way it is. ETD isn't just laying on legacy indicators. It uses advanced AI powered algorithms, large language models and.56:47Deep SQL aggregation to analyze the intent, condex and behavior of every message.57:07We hope this session provided a clearer understanding of how ETD Inlane approach can monetize your email security posture. Before you go, we would truly appreciate your feedback. Please take a moment to fill out the survey that you will get on your email after this session. Your inputs will help us remind refine will help us to refine these technical deep dives going further.57:12Lastly, if you'd like to keep pace with these evolving threats, please subscribe to our webinar portal to be notified of future expert insight series. Thank you again for your time and for trusting Cisco with your cisco security infrastructure. Have a great day, everyone.57:33