Antilure for companies
One IT person can put Antilure on every laptop and see what it flags, from a console that runs on your own server and receives metadata, not mail.
The console
A web app your company runs in Docker. It shows every computer, what was flagged and what people reported. The examples below are drawn in the console's layout with made-up data.
| Device | Group | Version | Last seen |
|---|---|---|---|
| LT-014 | Finance | 1.0.0 | 2 min ago |
| LT-007 | Finance | 1.0.0 | 4 min ago |
| LT-022 | Sales | 1.0.0 | 1 min ago |
| LT-031 | Sales | 1.0.0 | 3 h ago |
| Time | Device | Sender domain | Verdict |
|---|---|---|---|
| 12:54 | LT-014 | paypa1-alerts.invalid | Dangerous |
| 09:02 | LT-007 | acme-billing.invalid | Suspicious |
| 08:41 | LT-022 | secure-docs-share.invalid | Dangerous |
What admins see, and what they never see
- FleetEvery computer, its group, its version and when it last checked in.
- DetectionsFor each flagged message: the time, the device, the sender's domain, the verdict, the score and the tactics found.
- ReportsMessages that people chose to send to IT, when the group's policy allows reports.
- PoliciesPer group: warning thresholds, whether reports are allowed, and sender allow and block lists.
- ModelsUpload a signed model, roll it out to a group, and roll it back.
- Audit logEvery change an admin makes, with two roles: admin and analyst.
- The mail people readNo bodies, no subjects, no attachments, unless a person reports a message and confirms.
- Who wrote to whomOnly the sender's domain is sent, never the full address.
- Message idsEach message is identified by a hash of its id, not the id itself.
Report to IT is a person's choice. A message reaches the console only when someone clicks Report to IT and confirms, and only for groups whose policy allows reports. Set reporting to "metadata only" or "off" and nothing beyond metadata, or nothing at all, is sent.
Deployment
Three pieces, each with the tool you already use for it.
-
The agent on Windows
A per-user MSI. Push it with Intune, Group Policy or your usual tool, and enrol each computer with your console.
-
Gmail in Chrome and Edge
Install the extension for everyone with Chrome and Edge enterprise policy. Store listings are coming.
-
Outlook
Deploy the add-in to your users from the Microsoft 365 admin center, under Integrated apps.
- Console requirements
- Docker Compose on a server you control, an HTTPS address and a certificate for it.
- Model updates
- Signed. The console and every agent check the signature before they accept a model.
- Retention
- Detections are kept 180 days and reports 90 days by default.
- Platforms
- Windows first, macOS next. Gmail and Outlook today.
Looking after many companies?
If you're a managed service provider protecting several small companies, we'd like to hear how you work before we set the MSP plan.