Configuring Suspicious Object List

A suspicious object is a known malicious or potentially malicious IP address, domain, URL, or SHA-1 value found in submitted samples. After integrating with your Trend Vision One or Apex Central / Control Manager, Cloud App Security can use the Suspicious Object lists synchronized from these products during scanning.

Note:

The Suspicious Object List feature is disabled by default. It applies to all ATP policies.

Before you enable this feature, make sure your product that synchronizes the lists meets the following requirements.

Table 1.
Product	Version	Configuration
Trend Vision One	Latest version	On Trend Vision One: You have granted necessary permissions to receive data from Cloud App Security. You have selected the email accounts to monitor.
Apex Central / Control Manager	Apex Central 2019 or Control Manager 7.0 with hot fix HF2574 With a serving Deep Discovery Inspector or Virtual Analyzer product For details, see required products for Apex Central features.	Your Cloud App Security is registered to your Apex Central or registered to your Control Manager. You have configured distribution settings on your Apex Central / Control Manager.

Synchronization terminates when the above conditions are no longer satisfied. The Suspicious Object lists are cleared and no longer apply during scanning.

Go to Administration > Global Settings > Suspicious Object List.
On the Suspicious Object List screen that appears, enable or disable the use of the lists during scanning as necessary.
Click Save.
Cloud App Security utilizes the suspicious file list in Malware Scanning and the suspicious URL list in Web Reputation.

When a URL or file hits a list, Cloud App Security takes the action synchronized from Trend Vision One or Apex Central / Control Manager. The action can be either of the following:
- Pass: Record the detection in a log and leave the scanned item unchanged.
- Quarantine: Move the scanned item to a dedicated quarantine folder or object (for Salesforce)
  Note:
  The quarantine action does not apply to Gmail and Teams Chat. Instead, the following action applies:
  - For Gmail, label the email message as risky.
  - For Teams Chat, record a detection log and leave the message unchanged.