Implementation of Whitelist in Different Technologies

This article details how to implement Whitelist in various security and email technologies to ensure the proper delivery of SMARTFENSE simulations and reduce impacts from security analysis in Phishing and Ransomware campaigns.

Whitelist Implementation for Trend Micro

Domain Whitelisting in Trend Micro

Advanced Spam Protection

1. Go to the Advanced Threat Protection > Add tab.
2. Select the policy to create according to the service: Exchange, OneDrive, SharePoint, Box, Dropbox, Google.
3. On the left, select Advanced Spam Protection.
4. Check Enable Advanced Spam Protection.
5. Select Approved/Blocked Sender List.
6. Check Enable the approved sender list.
7. Enter *@livefense.com and press Add.
8. Go to the Rules configuration section.
9. In Apply to: select Incoming messages.
10. Select Medium as the detection level.

Malware Scanning

11. Select Malware Scanning in the left menu.
12. Select Rules.
13. In Apply to: select Incoming messages.
14. In Malware Scanning, select Scan all files and check Scan message body and Enable IntelliTrap.
15. Select the Action section.
16. In Action: select Trend Micro recommend actions.
17. In Notification: select Notify.

Web Reputation

18. Select Web Reputation.
19. Check Enable Web Reputation.
20. Select Rules.
21. In Apply to: select All messages.
22. In Security Level: select Medium.
23. Select Approved/Blocked URL List.
24. Check Enable the approved URL list.
25. Check Add internal domains to the approved URL list.
26. Enter the IPs and domains of SMARTFENSE as hostnames.
27. Press Add >.

Virtual Analyzer

28. Select Virtual Analyzer.
29. Check Enable Virtual Analyzer.
30. In Allowed senders list, add info@livefense.com.
31. Click Save.

Note: once all steps are configured, the policy will appear under the Advanced Threat Protection tab.

Hosted Email Security (HES) – Allow Campaigns and Do Not Scan URLs

Do Not Scan URLs in Phishing Campaign Emails

1. In the Hosted Email Security (HES) console go to:
   • Inbound Protection -> Policy Objects -> Keyword Expressions
2. Create a new keyword expression for SMARTFENSE:
   • Define Match as Any Specified
   • Click Add
   • Enter:
     • SMARTFENSE
     • This is a phishing security test by SMARTFENSE authorized by the receiving organization.
   • Click Save
3. Go to Inbound Protection -> Policy.
4. Select the domain to apply the policy and click Add.
5. In Basic Information, assign a name and check Enable.
6. In Recipients and Senders:
   • Recipients: My domains, select domain and Add
   • Senders: Anyone
7. In Scanning Criteria:
   • Click Advanced
   • Enable Specified header matches
   • Click keyword expressions
   • In Other, type X-PHISHINGSIMULATION
   • Choose the created expression and Add
   • Click Save
8. In Actions, select Deliver now.
9. Verify the policy is correctly configured.
10. Move the policy to the top to give it priority (up arrow).

Note: when the keyword matches, the email does not go through the rest of the policies and is delivered immediately to the end user.

Trend Micro Email Security (TMEMS) – Do Not Scan URLs

1. In Trend Micro Email Security (EMS) go to:
   • Administration -> Policy Objects -> Keyword Expressions
2. Create a new keyword expression for SMARTFENSE:
   • Match: Any Specified
   • Click Add
   • Enter:
     • SMARTFENSE
     • This is a phishing security test by SMARTFENSE authorized by the receiving organization.
   • Click Save
3. Go to Inbound Protection -> Policy.
4. Choose the domain, click Add.
5. In Basic Information, assign a name and activate Enable.
6. In Recipients and Senders:
   • Recipients: My domains, select domain and Add
   • Senders: Anyone
7. In Scanning Criteria:
   • Click Advanced
   • Enable Specified header matches
   • Click keyword expressions
   • In Other, type X-PHISHINGSIMULATION
   • Choose the created expression, Add, and then Save
8. In Actions, select Deliver now and select To the default mail server.
9. Review the policy.
10. Click Submit.
11. Move the policy to the top to give it priority.

Whitelist Implementation for AppRiver

1. Log in to AppRiver Admin Center.
2. Select Filters -> IP Addresses.
3. In Allowed IP Addresses, add the current SMARTFENSE IPs.
4. Click Save.

Whitelist Implementation for Cisco IronPort

IP Whitelist

1. From the Cisco IronPort console, go to Mail Policies.
2. Select HAT Overview and make sure to choose InboundMail lister.
3. Click WHITELIST.
4. Click Add Sender and add:
   • 160.153.250.248
   • 190.210.135.44
   • 50.6.200.66
   • 52.16.33.192
5. Click Submit and then Commit Changes.

Skipping Outbreak Filter Scanning

1. Go to Mail Policies.
2. In Message Modification, enter the IPs in Bypass Domain Scanning:
   • 160.153.250.248
   • 190.210.135.44
   • 52.16.33.192
3. Click Submit and then Commit Changes.

Whitelist Implementation for Zoho Mail

Add the IP to the trusted list in the administration panel:

1. Log in as administrator in Zoho Mail.
2. Go to Control panel >> Mail Administration >> Spam control >> Whitelist >> Trusted IP list.
3. Press Add IP Address, enter the IP and save.

User Spam Settings

Go to the official provider links to configure:

• Allowed list / blocked list
• Safe / rejected senders list

FortiGuard – Web Domain Override or Reclassification

To override web classification of URLs that may be considered malicious by FortiGuard, consult:

https://docs.fortinet.com/document/fortigate/latest/administration-guide/122974/web-rating-override

Sophos – How to Make Exceptions

Allows enabling URLs or domains regardless of category.
Configure a whitelist object using matching by Domain or by Regular Expression as needed.

Source:
https://docs.sophos.com/nsg/sophos-utm/utm/9.717/help/en-us/Content/utm/utmAdminGuide/WebProtWebFilterProfilesFilterActionsWebsites.htm

HARMONY – CHECK POINT

In the transport rule within the Microsoft Mail Server (usually “Harmony - Check Point”), add the IPs as exceptions:

• 160.153.250.248
• 190.210.135.44
• 50.6.200.66
• 52.16.33.192

This prevents Microsoft from sending simulation emails received from SMARTFENSE servers to Harmony.

ESET Protect Complete / Elite / MDR

If you use these suites and the ESET antispam platform (compatible with Office365 and Google Workspace), create an exclusion policy to allow the IPs:

• 160.153.250.248
• 190.210.135.44
• 50.6.200.66
• 52.16.33.192

Reference:
https://help.eset.com/ecos/es-CL/policy_email.html

How to whitelist SMARTFENSE domains in Proofpoint

This article explains how to add SMARTFENSE domains and URLs to the allow list in Proofpoint, so your users are not blocked when clicking links in simulated phishing campaigns or platform notifications.

Why is access being blocked?

Proofpoint includes a technology called URL Defense (part of Targeted Attack Protection, or TAP) that analyzes links in emails in real time. When Proofpoint classifies a URL as malicious, it blocks navigation and displays a warning screen to the user.

This block can occur even if the destination site is legitimate. Proofpoint explicitly states that it is possible to block a single page of a valid site without blocking the entire domain.

To allow your users to access SMARTFENSE links correctly, you need to configure the allow list at two levels: email filtering and URL Defense.

Prerequisites

• Administrator access to the Proofpoint console (Essentials or Enterprise).
• List of SMARTFENSE domains and IPs. Refer to the article Technical Information for Whitelisting for updated values.

Configuration in Proofpoint Essentials

Step 1 — Add SMARTFENSE to the Safe Sender List

1. Log in to the Proofpoint Essentials administration console.
2. Navigate to Security Settings > Email > Sender Lists.
3. Under the Safe Sender List section, enter SMARTFENSE's sending IPs and domains.
4. Click Save.

Step 2 — Exclude SMARTFENSE URLs from URL Defense rewriting

1. From the main menu, click Email Protection.
2. Under the Targeted Attack Protection drop-down, select URL Defense.
3. Click URL Rewrite Policies.
4. In the Exceptions section, under Exclude URLs that contain specified domains/IP addresses, enter the SMARTFENSE domains.
5. Click Save Changes.

Configuration in Proofpoint Enterprise

Step 1 — Add SMARTFENSE to the Organizational Safe List

1. Log in to the Proofpoint Enterprise administration console.
2. Click Email Protection.
3. Under the Spam Detection drop-down, select Organizational Safe List.
4. Click Add.
5. In the pop-up window, fill in the following fields:
   • Filter Type: select Sender Hostname.
   • Operator: select Equals.
   • Value: enter the SMARTFENSE domains.
6. Click Save Changes.

Step 2 — Exclude SMARTFENSE URLs from URL Defense rewriting

1. From the main menu, click Email Protection.
2. Under the Targeted Attack Protection drop-down, select URL Defense.
3. Click URL Rewrite Policies.
4. In the Exceptions section, enter the SMARTFENSE domains.
5. Click Save Changes.

Step 3 (optional) — Configure a rule in Email Firewall

If the previous steps are not sufficient, you can create an explicit allow rule:

1. In the Proofpoint Enterprise console, navigate to Email Firewall > Rules.
2. Enable the rule by switching Enable to On.
3. Assign a descriptive name, for example: SMARTFENSE Allow List.
4. Under Conditions, click Add Condition and select Sender Domain.
5. Enter the SMARTFENSE domains.
6. Save the changes.

If the issue persists after applying the allow list in Proofpoint, check whether additional protections are active on the client's mail server (for example, Microsoft 365 Defender) that may be blocking the same links independently.

💡 Best practices for Proofpoint

• Ask the client for the exact list of blocked domains before starting the configuration, to confirm they correspond to SMARTFENSE URLs.
• Apply the URL Defense exception first, as it is the layer that displays the blocking screen shown in the screenshot.
• Verify the allow list by sending a test email and confirming that the link opens correctly without being redirected to the Proofpoint block screen.
• Keep SMARTFENSE domains up to date in the Proofpoint configuration whenever new domains are added to the platform.
• Document in the client's file which Proofpoint console they use (Essentials or Enterprise) to make future adjustments easier.

💡 Best Practices in general

• Obtain the updated list of IPs and domains from Settings > Security > Whitelist before applying changes in external tools.
• Apply Whitelist both in antispam/antiphishing filters and in web reputation and URL analysis.
• Prioritize Whitelist rules above other policies to ensure delivery.
• Validate with a test campaign before running mass simulations.