Prevent Users Reporting CSA Emails To Mimecast

Please read through the guide, as it helps you to prevent users reporting the CSA emails to Mimecast and eventually getting them blocked. 

The Mimecast “Report Message” feature enables an end-user to report an email as per this screenshot: 

Should a User report one of the CSA specially created e-mail templates to Mimecast, then Mimecast will use their URL scanning solutions to test the safety of the e-mail and the link. In doing so, this will create a false-positive in the CSA reporting system because the link will have, in effect, been clicked as if the end-user clicked the link.

This document has been created to assist those organisations who have deployed this service and will outline how to create a Mimecast/Office 365 Mail Flow rule to stop these e-mails being sent to Mimecast's specific Phishing, Malware and Spam email addresses. 

Note: Only our specific emails will be prevented from being sent. All other suspected Malware, Phishing and Spam will be forwarded to Mimecast as you would expect. 

Create a Mail Flow Rule within Office 365 Exchange

1. Log into Microsoft Office with an Administrator user profile and select “Admin” for navigating to the Microsoft Admin Centre.                                                                                      

2. Once you are in the Admin Centre, click on Show All, then select Exchange, to navigate to the Exchange Admin Center.                                                          

3. Now, you need to select “Mail Flow” from the left-hand menu and then select “Rules” within the Mail Flow option.
   
    

4. Click on Add a Rule, then select Create a new Rule.
   
   
   
    

5. Give the new rule the name: "Block Outbound Mail – CSATraining". Under the first drop down,  'Apply this rule if...', select "The subject or body", and under the second drop down, select "Subject or body includes any of these words".
   
    

6. Then you will be prompted to enter words that are included in the subject or body, as according to the new rule. Enter "mail.csatraining.online" ; "mail.csatraining1.online" ; and "mail.csatraining2.online". These addresses are case-sensitive and have zero spaces. 
   
   Remember: you need to click on "Add" and then "Save", in order for the word to be entered on the new rule. Note: These 3 addresses need to be added one-by-one and not all together in the same prompted textbox. You will need to enter one address and then click on the "Add" button three times for each address. Please match the completed step with the screenshot below in order for it to be applied to the rule. 
   
                       
                  

7. Now, you need to click on the "+" button to add a condition to the new rule. 
   
   
    

8. Then you will be prompted with the similar 2 drop downs as before:
   
    

   
   
    

9. After you've selected the above, you will be prompted to enter recipient (email) addresses. Now, you need to add these 3 addresses: "spam@mimecast.org", "virusreports@mimecast.org", and  "phishing@mimecast.org",  [Remember - you need to click on "+Save" and the Save button, on the bottom of the page] as below:
   
   
    

10. Once you've done the above, under "Do the following..", you need to select "Block the Message" from the first drop-down menu, and "delete the message without... " from the second drop-down menu as below: 
    
     

     
    
     

11. The completed Rule Conditions should look something similar to this: 
    
    
     

12. Note: We recommend setting the Priority as 0, so that this is the first rule that is applied, and another separate rule does not clash and block the emails, where this rule will not be applied.

13. Now, you need to click on the "Next" button on the bottom of the page, to add and set the rule settings. You need to make sure that, the "Enforce" button is selected, and [optional] you can write something in the "Comments" section, to remind you something about the rule in future Audits.

14. The completed Rule, should look something like this:
    
     

    
    
     

15. Once you have clicked “Finish”, your rule is activated, and added to your list of rules.

You are able to check to see if the rule is working by returning to Outlook and reporting one of our emails to Mimecast. 

You can then complete a Message Trace to view the “Failed” delivery for all three spam@mimecast.org / virusreports@mimecast.org / phishing@mimecast.org

If you have any questions / queries regarding this guide, please let a member of the Cyber Support Team know, and they will be more than happy to help you.