<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-secure-email-gateway-tuning
description: >-
  Tune secure email gateway (SEG) configurations to optimize phishing
  detection rates, reduce false positives, configure quarantine policies,
  manage allow/block lists, and implement advanced filtering rules for
  maximum email security with minimal business disruption.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - email-gateway
  - seg-tuning
  - mail-filtering
  - false-positive
  - quarantine
  - transport-rules
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566"]
---

# Implementing Secure Email Gateway Tuning

## Overview

Secure email gateways are the primary technical control against phishing, but
out-of-box configurations leave detection gaps and generate false positives.
This skill covers tuning SEG policies, managing quarantine, configuring
transport rules, and reducing false positives.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| SEG admin access | Proofpoint, Mimecast, M365 Defender |
| PowerShell (M365) | `Install-Module ExchangeOnlineManagement` |
| Mail flow logs | Message trace data |

## Key Concepts

### SEG Tuning Areas

```
1. Detection Policies    — Phishing, spam, malware sensitivity
2. Quarantine Policies   — Quarantine vs block vs deliver
3. Allow/Block Lists     — Sender, domain, IP management
4. Transport Rules       — Custom mail flow rules
5. Safe Attachments      — Detonation policy
6. Impersonation Rules   — VIP protection
7. False Positive Mgmt   — Review and release workflows
```

### Detection Confidence Levels

| Level | Action | Review |
|---|---|---|
| High Confidence Phish | Block | No |
| Phish | Quarantine | Admin 4 hrs |
| High Confidence Spam | Quarantine | User self-service |
| Spam | Junk folder | No |

### Common Tuning Mistakes

| Mistake | Fix |
|---|---|
| Blanket domain allow | Allow by IP+domain pair |
| Default sensitivity | Raise to aggressive for executives |
| No VIP impersonation rules | Enable for C-suite + finance |

## Workflow

### 1. Audit Configuration

```bash
node agent.js audit-config --platform m365 --config-export /tmp/seg_config.json
node agent.js audit-lists --allow-list /tmp/allow.csv --block-list /tmp/block.csv
node agent.js analyze-quarantine --quarantine-log /tmp/quarantine.csv
```

### 2. Optimize Policies

```bash
node agent.js optimize-policies --config /tmp/seg_config.json --incident-log /tmp/incidents.csv
node agent.js tune-impersonation --vip-list /tmp/execs.txt --platform m365
node agent.js generate-transport-rules --gap-type external-reply-to
```

### 3. False Positive Management

```bash
node agent.js analyze-fp --quarantine-log /tmp/quarantine.csv --release-log /tmp/releases.csv
node agent.js generate-allow-rule --sender "news@vendor.com" --scope "marketing@co.com" --reason "Newsletter"
```

### 4. Reporting

```bash
node agent.js tuning-report --metrics /tmp/seg_metrics.json --period 2026-Q1 --output /tmp/report.json
node agent.js compare-tuning --before /tmp/pre.json --after /tmp/post.json
```

## Detection

```yaml
title: Secure Email Gateway Tuning Detection
id: 391aef83-1803-4a89-b934-603ea933c297
status: experimental
description: Detects suspicious activity related to implementing secure email gateway tuning techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1566
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| Config audited | All policy areas reviewed |
| Allow list cleaned | Risky entries removed |
| FP rate reduced | Fewer legitimate quarantines |
| Transport rules deployed | Custom rules active |

## References

- [Microsoft Defender Recommended Settings](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365)
- [NIST SP 800-177 — Trustworthy Email](https://csrc.nist.gov/publications/detail/sp/800-177/rev-1/final)
