Detection

This page includes:

About detection

You can specify various scanning configurations for your organization.

Note: These detection options do not apply to outbound emails. See Onboarding Microsoft 365 - Outbound.

Editing the default scanning configurations

To view or set the default scanning configurations:

  1. In FortiMail Workspace Security, in the left navigation menu, select Settings > Contracts and Channels.

  2. Under Enabled Channels, on the right of the page, click "Channel Settings". The Channel Settings pane opens.

    If you want to modify any of the settings, click Edit.

  3. Modify the options as required.

    See Channel settings - options below.

Channel settings - options

Detection

FP tolerance

[Visible - but not editable - by MSSP admin users only]

Sets the tolerance for false positive [FP] scans - for Malicious and Spam verdicts. By default, these are set to:

  • Malicious: Low

  • Spam: Medium

Very high minimizes the number of FPs - but may result in more malicious or spam instances not being detected. There is typically no need to change these settings. Contact FortiMail Workspace Security Support for assistance with changing either of these settings.

Channels to quarantine

[Future functionality]

Specifies for which channels quarantine will be performed.

  • SharePoint, and OneDrive and Teams will appear as options only if they are activated. For details on how to activate a channel, see Activating a channel.

  • You can select to quarantine SharePoint, and OneDrive and Teams only if Email Service is selected to be quarantined.

Quarantine according to verdict

Specifies which verdicts will cause emails or files to be quarantined. For details about quarantine, see Quarantine.

Follow URLs in emails

Active: Specifies if FortiMail Workspace Security should follow [click] URL links that are included in emails.

When URL links are followed, it is possible to exclude the following links from being followed [clicked]:

  • High reputation domains: High reputation domains are domains that FortiMail Workspace Security has found to be reliable. There is typically little benefit in clicking links in high reputation domains. Excluding high reputation domains reduces the scanning time.

  • Unsubscribe links: This prevents unintended un-subscriptions from being performed during scans. It is recommended that unsubscribe links are not followed.

    Note: It is possible to exclude additional URLs that you are confident are reliable. For details, contact FortiMail Workspace Security Support.

You can prevent FortiMail Workspace Security from "clicking" only specified URLs. For details, see Configuring the "URL allowlist".

See also: