Sophos Email customers using IP-based mailflow rule connectors must migrate to certificate-based configuration by March 31st. To see if you're affected Click Here.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 14 replies
  • Answers 1 answer
  • Subscribers 20 subscribers
  • Views 11365 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos filtered Email to M365 - Microsoft then removing legit emails as High Confidence Phish

Dennis Jones

We have many clients on Sophos filtering of email before delivery to m365

Yesterday we had several clients, where the email was "removed" (after delivery) from their inboxes and taken back to M365 quarantine as a "high confidence phish"

Essentially it was very much (all) the emails that contained a URL

I'm wondering if the Sophos modification of those URL's at the spam/virus filter end (safe links) prior to delivery, is upsetting "something" at M365 and what do we need to do to fix it?




This thread was automatically locked due to age.
Parents
  • +1

    Hello,

    This issue is being investigated under XGE-28086 

    If you’re being affected by this, please share the following in your case Details:

    1) Queue IDs of Affected Emails:

    Go to > Email Security > Logs & Reports > Message History > Subject (localize the affected emails and click the subject) > Raw Header and look for ESMTPS id 4PXYy06g0Kz1y9P (Usually around the 10th line) or let support which emails are being affected

    2) Remote Access ID:

    Top Right Corner > Click your name/Org > Account Details > Sophos Support > Turn on Remote Assistance > and COPY AND PASTE "The unique ID for this Sophos Central account is:" number

    3) Location of the Central Account :

    4) Mention XGE-28086 if the issue is with Mailflow or PHISH-8610 if the issue is related to Sophos Phish Threat 

    Top Right Corner > Click your name/Org > Account Details > Sophos Support > Scroll down to "This account is located in the XXXXXXXXXXXX region.

    Regards,

     
    Emmanuel (EmmoSophos)
    Technical Team Lead, Global Community Support
    Sophos Support Videos | Product Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
Reply
  • +1

    Hello,

    This issue is being investigated under XGE-28086 

    If you’re being affected by this, please share the following in your case Details:

    1) Queue IDs of Affected Emails:

    Go to > Email Security > Logs & Reports > Message History > Subject (localize the affected emails and click the subject) > Raw Header and look for ESMTPS id 4PXYy06g0Kz1y9P (Usually around the 10th line) or let support which emails are being affected

    2) Remote Access ID:

    Top Right Corner > Click your name/Org > Account Details > Sophos Support > Turn on Remote Assistance > and COPY AND PASTE "The unique ID for this Sophos Central account is:" number

    3) Location of the Central Account :

    4) Mention XGE-28086 if the issue is with Mailflow or PHISH-8610 if the issue is related to Sophos Phish Threat 

    Top Right Corner > Click your name/Org > Account Details > Sophos Support > Scroll down to "This account is located in the XXXXXXXXXXXX region.

    Regards,

     
    Emmanuel (EmmoSophos)
    Technical Team Lead, Global Community Support
    Sophos Support Videos | Product Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
Children
Unfiltered HTML