Creating an Advanced Email Assessment with User-defined Criteria

Procedure

1. Click Detection & Response → Assessments.
2. Expand Create Assessment, and select Advanced and Emails.
3. To manually define criteria, select User-defined.
   For OpenIOC criteria, see Creating an Advanced Email Assessment with OpenIOC Criteria.
4. Enter a task name or use the generated task name.
5. (Optional) Click Saved Criteria, select one criteria set from the list, and click Apply Criteria.

   Note Applying saved criteria overwrites any criteria already specified.

6. Configure up to ten assessment criteria.
   You can use the criteria types listed in the table below.

   Advanced Assessment Available Criteria Types

   Category	Criteria Type
   Email information	Sender email address
   	IP or domain of sender email server
   	Recipient email address
   	Message subject
   File attachments	Attached file name
   	Attached file SHA-1 hash value
   	File extension
   Embedded links	Embedded URL

7. Select the data period
   • Last 7 days
   • Last 14 days
   • Last 30 days (default)
8. Click Select Customers, then choose the customers to include in the assessment.
   Only customers with EDR or XDR licenses are available for selection.
9. (Optional) Click to save your criteria.
10. Click Assess Impact.