Sophos Phish Threat v2 misreporting campaign results

Hi everyone,

I have recently sent out a campaign to all employee's and some are saying that they did not click on the link but the report shows that they did, I currently have a support case open with Sophos but we was unable to replicate the issue, they advised checking me to check Exchange logs or other appliance for any filtering that might open an email prior to delivery but we are more concerned about the link actually being clicked on.

No users ever reported this issue when I sent out previous campaigns in v1, this is the first time I have sent out a campaign in v2. I know that it is misreporting as it shows two users have clicked on the link when they have never logged onto their AD account as their AD accounts are both set to 'Change passwords at next logon', I have also checked if their emails are being forwarded via a Powershell command to which they are not.

Please can anyone help as we are worried that we will have to stop using Phish Threat due to incorrect results.

Kind regards

Kaylie

  • Hi  

    My apologies regarding this issue you are experiencing.

    Would it be possible to please share your support case number with me via PM so I can review the initial troubleshooting that has already been performed?

    Thanks!

  • I gotta ask, please do not take this as me being a Smart A**

     

    But basically you are saying that you ran the first test with no issues, but when you ran the 2nd test many users are saying they did not click on the link but Sophos shows them doing so?

     

    If that's the case I would suggest that maybe they are just telling you that???  Many people know if they make a big enough stink, things go away.

     

    Also just a thought, but send out another campaign and ask everyone to not even open the email or just send it to a few people you know for sure will follow your instructions, wait a week and see if Sophos reports any as clicking on the link.  This way you would know if something is opening the emails before getting to their mail box.

     

    Also and I just do not remember, but is there a timestamp on when they opened the link?  And if so is it before or after the mail arrived in their mailbox?

  • In reply to ryan jenson:

    Wow, I am so sorry that I missed this ! 

    UPDATE: Back then I received this article https://community.sophos.com/kb/en-us/131747 from Sophos Support which basically says if the Phish Threat V2 IP address and domain names are not included in the allow list, Office 365 executes the links making it appear like an end user has clicked on the links. To ensure the proper execution of Phish Threat V2 with Office 365, set up an exception for the Phish Threat V2 IP addresses and domains for both Safe Links and Safe Attachments in Office 365 and provided a link on how to set up these exceptions.

    So I did this, I've now done more campaigns and the results are only showing the emails as being sent despite me opening the email, I have logged another support call with Sophos, I desperately need this working 

    Please help ! I can't be the only one experiencing this :-(

    Kind regards

    Kaylie

  • In reply to Kaylie Watts:

    Hi Kaylie,

    My apologies for this, would it be possible to share your most recent case number so that I can follow up?

    Thanks,

  • In reply to FloSupport:

    Hi,

     

    It is  [#9170808]

     

    Kind regards

     

    Kaylie

  • In reply to Kaylie Watts:

    Hi Kaylie,

    Thanks for following up!

    Your case has already been escalated, I will continue to monitor it's progress. Will update this thread accordingly once a solution has been determined.

    Please don't hesitate to PM me directly if you had any questions or concerns.

    Regards,

  • In reply to FloSupport:

    I have a fix! Provided by Sophos

    1. Follow this artice https://community.sophos.com/kb/en-us/131747 to whitelist the Sophos addresses / domains within Office 365 and your spam filter (Mine is Mimecast) - Create the bypass safe links and attachments within Office 365.

    2. The 'Open' statistics will not be reported until the tracking image in the Phish Threat Campaign email has been downloaded. Your current email client settings prevent the automatic download of images in emails, so this is why the 'Open' statistic fails to be reported in the Phish Threat Dashboard. To workaround this issue, follow this article: https://sophos.com/kb/127575 to which it provides this link: https://support.microsoft.com/en-ph/help/2252421/how-to-deploy-junk-email-settings-such-as-the-safe-senders-list-by-usi which is a Microsoft article - This isn't as clear as it needs to be, I followed it to a tea and it caused major issues having the junk email folder setting to Safe Lists Only as it made legitimate emails constantly go to users junk folders, the setting needs to be "No Automatic Filtering":

    The Safe Senders and Safe Recipients need to contain the Sophos domains in, these can be imported via a text file but the text file needs to be stored in a drive where all users have access to.

    I hope this helps! It has worked for me and I am so glad !

    Kind regards

    Kaylie