Introducing LimaCharlie Email Security: One Phish, Start to Finish

Introducing LimaCharlie Email Security. It connects to Microsoft 365 or Google Workspace through the provider's API, with no MX change and nothing in the delivery path, and shows the signals behind its verdicts.

This walkthrough follows one malicious email from its 94/100 verdict through how the score compounds, a benign contrast with its measured processing timeline, the evidence, link analysis, response at the provider, hunting across the organization, groups and campaigns, user reports, the rule that caught it, policy, and email as telemetry for detection and response rules.

The walkthrough was recorded in the organization LimaCharlie engineers use to validate Email Security, so most messages shown are their test traffic. Nothing was changed, remediated or confirmed during the recording.

Chapters:

0:00 Introducing Email Security

0:13 How it works

0:51 Connecting a provider

1:35 Proving the connection

1:53 Overview

2:16 The queue

2:30 How the score works

2:58 A benign one, for contrast

3:21 The evidence

3:39 Following the link

4:01 Responding

4:37 Hunting across the organization

4:56 Groups and campaigns

5:19 User reports

5:35 The rule that caught it

6:10 Policy

6:32 It's all telemetry

Try it free on LimaCharlie's free tier: https://limacharlie.io
Docs: https://docs.limacharlie.io/email-security/