Salesforce SDO Setup Guide

Open the Attack Simulator and insert your email-to-case email address.

As an existing [Company Name] customer, Lauren can contact support via a few different channels, but she’s always on the go and finds email to be the easiest. Today she has an issue with a turbine she recently installed, so she’s going to reach out for support.

Attack Simulator

Subject: Turbine without Power

Description:
Hi there,

I installed a new turbine two weeks ago and it seems to have stopped producing power. I attached my warranty for your review and you can find a video of the generator here: http://unsafe.fstestdomain.com .

Let me know if you need any additional information, Lauren

Lauren adds some information about the issue she’s having with her turbine, including a link to a video of the turbine, and she attaches the product warranty.

She sends it off and goes about her day while she waits for a response from the support team.

View Case → make note of the Case Number

You can see here that I was able to successfully create a Case. Note that we really don’t want to change the experience for third parties uploading files and URLs, because we don’t want them to know if this is a protected or non-protected vector for attacks.

Note that this is Case #00001737.

Now let’s see what the experience is like for your internal Salesforce users.

Customer/Partner Experience

Return to the service app

→ Service Console App

→ Open “All Cases” list view; sort by Date/Time Opened

→ Open the Case you just created

Within Service Cloud I can see a list of all cases; some of these might originate from Email-to-Case, some might originate from Experience Cloud. Either way all Cases end up here in Salesforce.

Here’s the Case Lauren just created regarding her turbine.

Explain file scanning and the internal user’s experience.

The first thing I want to call out is that WithSecure’s Security Cloud has already processed the file and removed it according to your company’s policy. Almost all files are processed in less than 60 seconds.

It’s best practice to let an agent know that there was harmful content found, so we replace all files with a .txt file, where you can customize the messaging that appears when an agent clicks on the file. This way if a customer or partner is referencing an attachment, there’s no confusion for the internal user.

Click on the URL in the Case description field on the right-hand side.

Explain URL scanning and the internal user’s experience.

Next, notice how we replaced the URL the customer included. WithSecure replaces all URLs with Click Time Protection links, whether or not they’re malicious. That’s because websites can change and redirect to different sites after certain periods of time, so it’s important to scan URLs each time a Salesforce user clicks on them.

We show your internal user the original link in parentheses, but even that link has been slightly reformatted to prevent your users from accessing it accidentally.

When users click on the link they’ll see a message noting that the harmful website has been blocked. You can of course customize this messaging as well if there are additional actions you want internal users to take.

Before we take a look at the administrator and security team’s experience, are there any additional questions about your internal Salesforce users or external customers/partners experiences?

End of Agent Experience

Navigate to App Launcher → Cloud Protection application

Because Cloud Protection for Salesforce is built on the Salesforce platform, you can configure and administer everything directly from your org. This is where your administrators and security team can see an overview of file and URL scans, monitor your org’s alerts and configure your CPSF settings.

Analytics tab → File Events

Equally as important as scanning and removing malicious files is being able to analyze who uploaded them, who has tried to view them, and other important details like IP address.

When malicious files are removed an email alert can be sent to any group of users you’d like, and then they can come here to investigate further.

Click View for the file you uploaded

We can dig in and see analytics around this particular file like the file type, file size and the SHA1, which is essentially each file’s digital fingerprint.

Notice how we can also open the related record to help gather context and see other details around that Case.

Administration tab → Quarantine tab

Removed files are stored in the Quarantine tab which can be found under Administration. It follows the same rules as your Salesforce recycle bin, which is set by default to keep deleted items for 15 days.

If you think there may have been a false positive you can select that file and click “Restore”, but note that it will go through our scanning engine again and likely be removed again. You can always copy the SHA1 and send it to our team to analyze it manually before restoring it.

Manual Scan tab

If you want to scan existing files and attachments in your org when getting started, we can do a manual scan to make sure no content that’s already in your org is malicious.

Customers typically do this once when getting started and then have all new files and attachments scanned automatically.

File Protection tab

In the File Protection tab you can configure the scanning behavior in your org.

You’re able to configure disallowed content, which means that certain file types could be blocked from being uploaded before they’re even sent to our security cloud for analysis.

This is also where you can configure what happens when harmful content is found, as well as what those different notifications look like.

URL Protection tab

Here you can see and configure where we’re able to scan URLs for harmful content.

You can also do things like block certain websites if they have a poor reputation or if their content relates to certain disallowed categories.

Analytics tab → URL Events

Here we can see all actions around different URLs, who posted them, who tried to click on them, the IP address etc.