Configuring impersonation profiles

Email impersonation is a type of email spoofing attack. It forges the email header to deceive the recipient because the message appears to be from a different source than the actual address.

To use this feature, you must have a license for the Fortinet Enterprise Advanced Threat Protection (ATP) bundle.

To fight against email impersonation, you can map high valued target display names with correct email addresses and FortiMail can check for the mapping. For example, an external spammer wants to impersonate the CEO of your company(ceo@company.com). The spammer will put From: CEO ABC <ceo@external.com> in the email header, and send such email to a user(victim@company.com). If FortiMail has been configured with a manual entry "CEO ABC"/"ceo@company.com" in an impersonation analysis profile to indicate the correct display name/email pair, or it has learned display name/email pair through the dynamic process, then such email will be detected by impersonation analysis, because the spammer uses an external email address and an internal user's display name.

Impersonation analysis inspects both the From: and Reply-To: message headers.

Entries can be mapped either:

• Manually: You enter mappings between display names and email addresses.
• Dynamically: The FortiMail mail statistics service automatically learns the mappings.

To create an impersonation analysis profile

1. Go to Profile > AntiSpam > Impersonation.

2. Either click New or Clone to add a profile, or double-click a profile to modify it.

   Alternatively, see Batch editing antispam profiles.

3. Configure the following:

   GUI item		Description
   Domain		Select which protected domain this profile belongs to, or System (all protected domains can use this profile). You can only see the domains that are permitted by your administrator profile. See About administrator account permissions and domains.
   Name		Enter a unique name.
   Comment		Enter a comment or description.

4. In the Impersonation section, select either Match Rule or Exempt Rule.

   To avoid false positives, impersonation analysis also follows some other exemptions.

5. Click New and then configure the following:

   GUI item	Description
   Display name pattern	Enter the display name to be mapped to the email address. You can use a wildcard or regular expression.
   Pattern type	Select either: Wildcard Regular expression See Appendix D: Wildcards and regular expressions.
   Email address	Enter the email address to be mapped to the display name. The email address can be from protected/internal domains or unprotected/external domains. If the email address is from an external domain, such as gmail.com or hotmail.com, the display name matching the external email address will be passed. Otherwise, it will be caught by impersonation analysis.

6. Click Create.

7. Repeat the previous step until all rules have been created.

8. Click Create or OK.

9. To apply impersonation profile, select it in an antispam profile. For details, see Business email compromise section.