Domain Spoofing Security Copilot Agent is designed to protect your organization's email channels by proactively identifying and mitigating domain spoofing and lookalike domain attacks. Its primary objectives are:

Detection:
•  Detect domain spoofing attempts where unauthorized senders impersonate your legitimate domains
•  Identify lookalike domain attacks using similarity algorithms against your organization's trusted domains
Remediation:
•  Automatically move to junk the emails identified as spoofing attempts with detailed reporting

The Domain Spoofing agent will:

Step 3: Triggers for Agent Activation
Scheduled Execution:

• The agent operates on a 60-minute recurring schedule, automatically:
• Collecting email events from the past 60 minutes via Microsoft Defender for Office 365 logs
• Processing all incoming emails through the validation workflow
• Generating real-time threat reports and taking appropriate remediation actions

Manual Activation:

• Security analysts can manually trigger the agent for specific time ranges