Jump to Content
Documentation
API Reference
Log In
Log In
Moon (Dark Mode)
Sun (Light Mode)
Documentation
API Reference
Search
Loading…
Getting Started
Introduction
Installation
Docker
AWS CloudFormation
Add a message source
Add a Microsoft 365 message source
Add a Google Workspace message source
Add an IMAP message source
User-reported phishing
Add your abuse mailbox
Microsoft 365's Native “Report phishing” feature
Gmail's "Report phishing" feature
MQL Rules
Detection Rules
Triage Rules
Actions
Webhook
Email Alert
Email Alert with EML Attached
Slack Alert
Auto-trash
Quarantine
Warning Banners
Track Link Clicks
Auto-review
Rule Feeds
Private rule feed authentication
Rules file format (YAML)
Lists
Configure the org_vips list
Global Exclusions
YARA
Attack Surface Reduction
Reference
Message Data Model (MDM)
Message Query Language (MQL)
Syntax
Functions
Strings functions
RegEx functions
Enrichment functions
Missing or null values
Common snippets
Using the MQL Editor
Message groups
Message types
Role-Based Access Control (RBAC)
Message Access Controls
Rule Severity
How-to Guides
How to set up a custom domain
How to set up Single sign-on (SSO)
How-to MQL Guides
How to detect keywords or phrases in the body content of messages
How to detect lookalike domains
How to detect text in attachments
How to use message header values in a rule
Powered by
Tutorials
Suggest Edits
Updated over 1 year ago