How do I safelist in Avanan?

This article details the steps necessary to setup safelisting in Avanan for both Microsoft 365 and Google Workspace clients.

Microsoft 365

For phishing emails to be delivered successfully, a header must be added to mail coming from PhishingBox IP's. This header will inform Avanan that the incoming mail is safe to be delivered to the inbox. Follow the steps below to create this mail flow rule in Exchange Admin Center:

1. Navigate to admin.exchange.microsoft.com > Mail flow > Rules
   
2. Click the  button and select "Create a new rule"
3. In the new rule pop-up, input the following:
   • Name: Input an appropriate name like "PhishingBox Avanan Safelisting"
   • Apply this rule if: "The sender" | "IP address is any of these ranges or exactly matches"
     • In the "specify IP address ranges" pop-up, input the PhishingBox's mail IP's:
       • US Clients:
         • 64.191.166.196 (Phishing Mail) and click "Add"
         • 64.191.166.197 (Training Mail) and click "Add"
       • EU Clients
         • 64.238.34.10 (Phishing Mail) and click "Add"
         • 64.238.34.11 (Phishing Mail) and click "Add"
         • 64.191.166.197 (Training Mail) and click "Add"
     • Click "Save
   • Do the following: "Modify the message properties" | "set a message header"
     
     • Click the first "Enter text" link
     • Input "X-CLOUD-SEC-AV-Info" and click "Save"
     • Click the second "Enter text" link and input "{portalname},office365_emails,inline" (replace {portalname} with the name of your Avanan portal) and click "Save"
     • 
     • 1. Click "Next"
       2. Set "Rule Mode" to Enforce
       3. Check the Stop processing more rules box 
       4. Click "Next"
       5. Click "Finish" and then "Done"
       6. Click the check box for the new rule and click "Edit"
       7. Click the "Settings" tab
       8. Change the priority so that its above the "Avanan - Protect" mail flow rule

       Google Workspace

       To ensure phishing email delivery, you must modify the existing Avanan content compliance rule and create one new rule. Below are the steps to achieve this:

       Modify Existing Rule

       1. Navigate to admin.google.com > Apps > Google Workspace > Gmail
       2. Expand the Compliance section 
       3. In the Content compliance section, click "Edit" on your existing Avanan rule
       4. In the pop-up, click "Edit" on the expression under step 2
       5. Modify the expression fields to the following:
          1. Metadata match
          2. Attribute: Source IP
          3. Match Type: Source IP is not within the following range: 64.191.166.192/28
             

             NOTE: EU clients will need to add two expressions that use the same settings above but with these two IP ranges: 64.191.166.192/28 and 64.238.34.8/30

       6. Click "Save"

       Create New Rule

       1. Navigate to admin.google.com > Apps > Google Workspace > Gmail
       2. Expand the Compliance section
       3. Click "Configure" or "Add another rule" in the Content compliance section 
       4. In the "Add setting" pop-up, input the following settings:
          1. Content Compliance: Input an appropriate name like "PhishingBox Avanan Safelisting"
          2. Email messages to affect: Inbound
          3. Add expression that describe the content you want to search for in each message:
             1. If ALL of the following match the message
                1. Expressions:
                   1. Metadata match
                   2. Attribute: Source IP
                   3. Match type: Source IP is within the following range: 64.191.166.192/28
                      

                      NOTE: EU clients will need to add two expressions that use the same settings above but with these two IP ranges: 64.191.166.192/28 and 64.238.34.8/30

          4. If the above expressions match, do the following:
             1. Modify message:
                1. Headers: Add custom headers 
                   1. Header key: "CLOUD-SEC-AV-Info"
                   2. Header value: "{portalname},google_mail,inline" (replace {portalname} with the name of your Avanan portal)
                   3. Click "Save"
       5. Click "Save"