The Cisco Secure Awareness cloud service allows you to effectively deploy phishing simulations, awareness training, or both to measure and report results. It empowers the security operations team to focus on real-time threats and not end-user mitigation.

The Cisco Secure Awareness cloud service provides reports of repeat clickers - users who repeatedly click on any URL or attachment in messages. These users are identified via a phishing simulation campaign defined by the Cisco Secure Awareness cloud service.

For more information on the Cisco Secure Awareness cloud service, see https://secat.cisco.com.

You can integrate your email gateway with the Cisco Secure Awareness cloud service to:

• Improve end-user awareness towards real-world phishing attacks.

• Allow email administrators to configure stringent policies for users identified as repeat clickers.

Perform these steps in order:

Depending on your region, create a Cisco Secure Awareness cloud service account with admin acess rights for your organization using one of the following URLs:

• https://secat.cisco.com [applicable for Americas users]

• https://secat-eu.cisco.com [applicable for European Union (EU) users]

What to do Next

Configure firewall settings to connect your email gateway to the Cisco Secure Awareness cloud service. For more information, see Configuring Firewall Settings to Access Cisco Secure Awareness Cloud Service

You must open HTTPS (Out) 443 port on the firewall for the following hostnames or IP addresses (refer to the table below) to connect your email gateway to the Cisco Secure Awareness cloud service.

Note	The IP addresses listed in the above table may change. For the latest list of IP addresses, see the ‘IP Allowlist Guide’ on the Cisco Secure Awareness cloud service at https://secat.cisco.com/portal/Support/IpWhitelistingGuide

What to do Next

Create a new sender group to allow simulated phishing messsages from the Cisco Secure Awareness cloud service in your email gateway. For more information, see Creating Sender Group to Allow Simulated Phishing Messages in Email Gateway

If you use centralized management, you can enable the Cisco Secure Awareness cloud service at the cluster, group, and machine level. If you have enabled your email gateway with the Cisco Secure Awareness cloud service in standalone mode, you can choose to join a cluster registered with the Cisco Secure Awareness cloud service.

Note	When you disable the Cisco Secure Awareness cloud service at the machine level, it is disabled only for the logged-in email gateway while the other machines in the cluster are still connected to the Cisco Secure Awareness cloud service.

The Cisco Secure Awareness cloud service information is posted to the Mail Logs. Most information is at the Info or Debug level.

Examples of Cisco Secure Awareness Log Entries:

• In this example, the log shows that the download of the Repeat Clickers list from the Cisco Secure Awareness cloud service failed because of an invalid token.

  Tue Oct 13 10:12:59 2020 Warning: CSA: 
  The download of the Repeat Clickers list from
  the Cisco Secure Awareness cloud service failed because 
  of an invalid token.

  Solution: Make sure you obtain a valid authentication token from the Cisco Secure Awareness cloud service.

• In this example, the log shows that the download of the Repeat Clickers list from the Cisco Secure Awareness cloud service failed because of a connection error.

  Wed Oct 14 10:59:36 2020 Warning: CSA: 
  The download of the Repeat Clickers list from
  the Cisco Secure Awareness cloud service failed because
  of a connection error.

  Solution: Verify the firewall configuration settings used to connect your email gateway to the Cisco Secure Awareness cloud service.

• In this example, the log shows that the download of the Repeat Clickers list from the Cisco Secure Awareness cloud service failed because of an internal server error.

  Wed Oct 14 10:59:36 2020 Warning: CSA: 
  The download of the Repeat Clickers list from
  the Cisco Secure Awareness cloud service failed because 
  of an internal server error.

  Solution: Contact Cisco Support for technical assistance.

• In this example, the log shows that the download of the Repeat Clickers list from the Cisco Secure Awareness cloud service failed because the SSL certificate verification failed.

  Wed Oct 14 11:02:46 2020 Warning: CSA:
   The download of the Repeat Clickers list from
  the Cisco Secure Awareness cloud service failed because
  the SSL certificate verification failed.

  Solution: Add the required CA certificate of the proxy server in the custom certificate authority list of your email gateway.

• In this example, the log shows that the download of the Repeat Clickers list from the Cisco Secure Awareness cloud service failed because the proxy authentication failed.

  Wed Oct 14 11:09:48 2020 Warning: CSA: 
  The download of the Repeat Clickers list from
  the Cisco Secure Awareness cloud service failed 
  because the proxy authentication failed.

  Solution: Check whether the proxy server is configured with the correct authentication credentials in your email gateway.

• In this example, the log shows that a request to the Cisco Secure Awareness cloud service failed because the Report API was not enabled on the Cisco Secure Awareness cloud service.

  Mon Aug 17 15:35:42 2020 Warning: CSA: 
  The download of the Repeat Clickers list failed.
  A request to the CSA cloud service failed because
  the Report API was not enabled on the CSA cloud service

  Solution: Check the Enable Report API check box in Environment > Settings > Report API tab of the Cisco Secure Awareness cloud service.

• In this example, the log shows that the Cisco Secure Awareness feature expires on a particular date.

  2020-10-15 08:00:11,968 INFO csa The Cisco Secure
  Awareness feature expires on 2029-12-28T23:59:59Z. You need to
  contact your Cisco Account Manager to renew the license.

  Solution: Contact your Cisco Account Manager to renew the license.

• In this example, the log shows that the Cisco Secure Awareness feature license has expired, and the feature is disabled on your email gateway.

  2020-10-27 13:33:21,714 CRITICAL csa The Cisco Secure 
  Awareness feature license has expired, and the feature is 
  disabled on your email gateway. Contact your Cisco Account Manager 
  to renew the license.

  Solution: Contact your Cisco Account Manager to renew the license.

• In this example, the log shows that the downloaded Repeat Clickers list is empty.

  Tue Oct 13 10:10:18 2020 Info: CSA: The downloaded 
  Repeat Clickers list is empty.

  Solution: Create simulated phishing messages in the Cisco Secure Awareness cloud service and send them to the recipients in your organization.

• In this example, the log shows that the download of the Repeat Clickers list from the Cisco Secure Awareness cloud service failed because you have reached the maximum number of download attempts.

  Fri Oct 16 05:22:08 2020 Warning: CSA: The download 
  of the Repeat Clickers list from the Cisco Secure Awareness
  cloud service failed because you have reached the maximum
  number of attempts.

  Solution: Contact Cisco Support to increase the number of attempts to download the Repeat Clickers list from the Cisco Secure Awareness cloud service.

The following table lists the system alerts generated for the Cisco Secure Awareness cloud service, including a description of the alert and the alert severity.