Domain Spoofing Security Copilot Agent

Domain Spoofing Security Copilot Agent is designed to protect your organization's email channels by proactively identifying and mitigating domain spoofing and lookalike domain attacks. Its primary objectives are:

Detection:
•  Detect domain spoofing attempts where unauthorized senders impersonate your legitimate domains
•  Identify lookalike domain attacks using similarity algorithms against your organization's trusted domains
Remediation:
•  Automatically move to junk the emails identified as spoofing attempts with detailed reporting

The Domain Spoofing agent will:

Step 3: Triggers for Agent Activation
Scheduled Execution:

• The agent operates on a 60-minute recurring schedule, automatically:
• Collecting email events from the past 60 minutes via Microsoft Defender for Office 365 logs
• Processing all incoming emails through the validation workflow
• Generating real-time threat reports and taking appropriate remediation actions

Manual Activation:

• Security analysts can manually trigger the agent for specific time ranges