Table of contents:
2) How do I whitelist Right-hand in Avanan(Checkpoint Harmony) with the help of Google Workspace rules?
If your organization employs Avanan, you can whitelist Right-Hand in Microsoft 365 and Google Workspace to ensure our simulated phishing emails and training notifications are delivered. To achieve this, establish rules in Microsoft 365 and Google Workspace that inform Avanan to avoid blocking or filtering emails from Right-Hand.
This will help our emails reach your users' Microsoft Exchange and Gmail inboxes.
How do I whitelist Right-hand in Avanan with the help of Microsoft Office 365 mail flow rules?
To whitelist Right-Hand in Office 365, you must set up a mail flow rule in the Exchange admin center. This rule will detect emails from Right-Hand's IP addresses and add a header to inform Avanan that the email is safe.
To create this mail flow rule, follow these steps:
Sign in to your Microsoft Admin console.
In the navigation panel, go to Admin centers > Exchange. Alternatively, you can access the Exchange admin center directly by visiting admin.exchange.microsoft.com.
In the navigation panel, go to mail flow > rules.
Click the plus sign icon at the top of the page to open a drop-down menu.
Select Create a new rule from the drop-down menu. This will open a new rule pop-up window.
In the Name field, input a name for the rule. For instance, you might enter "Right-Hand Whitelisting".
In the Apply this rule if… drop-down menu, hover over The sender, then choose IP address is any of these ranges or exactly matches. This will display a pop-up window to specify IP address ranges.
In the pop-up window, enter the IP addresses listed in the "Whitelisting best practices" article. After entering each IP address, click the Add button to add it.
Click the Save button.
In the Do the following… drop-down menu, choose Modify the message properties, then select set a message header.
Click the first Enter text… option beside the Do the following... field. This will open a message header pop-up window.
In the Header name field, type X-CLOUD-SEC-AV-Info.
Click the Save button.
Click the second Enter text… option next to the Do the following... field. This will open a header value pop-up window.
In the pop-up window, type [portalname],office365_emails, inline, substituting [portalname] with the name of your Avanan portal.
Click the Save button and click Next.
In the Set rule settings section, from the drop-down named Severity choose High from the list of options.
In the Rule mode section, select the Enforce option.
Check the box labeled Stop processing more rules.
Click the Next, and Finish button on the next page, to implement this rule on your server.
For additional details on mail flow rules in Office 365, refer to Microsoft's article titled Manage mail flow rules in Exchange Online.
How do I whitelist Right-hand in Avanan(Checkpoint Harmony) with the help of Google Workspace rules?
To whitelist Right-Hand for Gmail, you must set up a new content compliance rule and modify an existing Avanan rule. The new rule will identify Right-Hand IP addresses and add a header to indicate to Avanan that the message is safe.
This setup will prevent any sandboxing tools used by your organization from blocking simulated phishing tests and training notifications.
Start by creating a content compliance rule using the following steps:
Sign in to your Google Admin console.
From the Admin console home page, go to Apps > Google Workspace > Gmail.
If you manage multiple organizations, select the organization where you want to apply the rule from the navigation panel.
Navigate down to the Compliance section of the page.
Place your cursor over the Content Compliance setting.
Click either the CONFIGURE or ADD ANOTHER RULE button, depending on if a rule has already been added. This will open an Add setting pop-up window.
In the Content compliance section, describe this rule. For instance, you could enter "Right-Hand Whitelisting".
In step one, select the Inbound check box.
In step two, complete the fields by following these instructions:
a) Choose "If ALL of the following match the message" from the drop-down menu to display the Expressions section.
b) Then, click the ADD button in the Expressions section.
c) Next, select "Metadata match" from the drop-down menu.
d) In the Message authentication drop-down menu, choose "Source IP" and then in the Match type drop-down menu choose "Source IP is within the following range".
e) Finally, enter "168.245.54.27/32" in the Match type field and click Save.
In step 3, complete the fields by following these steps:
a) Choose "Modify message" from the drop-down menu.
b) Then, under Headers, check the box labeled "Add custom headers" to display the Custom headers section.
c) In this section, click the ADD button.
d) Enter "X-CLOUD-SEC-AV-Info" in the Header name field.
e) Lastly, in the Value field, input [portalname],googlr_mail, inline, but substitute [portalname] with your Avanan portal name.
11. Click the SAVE button and Save the settings.
Next, update the current content compliance rule using the steps below:
Go back to the Compliance section of your Gmail settings.
Place your cursor over the Content Compliance setting.
Click the EDIT button. This action will open the Add setting pop-up window again.
In step two, click Add next to the [portal_name]__inline_ei rule, replacing [portal name] with the name of your Avanan portal.
Update the fields by following these steps:
a. Choose "Metadata match" from the initial drop-down menu.
b. Select "Source IP" from the Attribute drop-down menu.
c. Opt for "Source IP is not within the following range" from the Match type drop-down menu. This selection will prompt a field to appear below the drop-down menu.
d. Enter 168.245.54.27/32 into the Match type field.
Click the SAVE button. You will now find two conditions listed under this rule.
To learn more about content compliance rules in Google Workspace, refer to Google’s page on setting up rules for advanced email content filtering.