Domain Spoofing Security Copilot Agent is designed to protect your organization's email channels by proactively identifying and mitigating domain spoofing and lookalike domain attacks. Its primary objectives are:

Detection:
• Detect domain spoofing attempts where unauthorized senders impersonate your legitimate domains
• Identify lookalike domain attacks using similarity algorithms against your organization's trusted domains
Remediation:
• Automatically move to junk the emails identified as spoofing attempts with detailed reporting

The Domain Spoofing agent will:

Step 1: Domain Spoofing Detection

Compare the sender's "Mail From" address against the sender's "From" address
Detect spoofing when domains don't match or when the sender impersonates organization domains
If spoofing is detected, the tool will immediately move the email to a junk folder and generate a detailed report

Step 2: Lookalike Domain Detection

Analyze sender domain against your organization's legitimate domains using KQL Queries
Calculate domain similarity scores using techniques like Levenshtein distance
If lookalike is detected, it will automatically generate a detailed report.

Step 3: Triggers for Agent Activation
Scheduled Execution:

The agent operates on a 60-minute recurring schedule, automatically:
Collecting email events from the past 60 minutes via Microsoft Defender for Office 365 logs
Processing all incoming emails through the validation workflow
Generating real-time threat reports and taking appropriate remediation actions

Manual Activation:

Security analysts can manually trigger the agent for specific time ranges

Domain Spoofing Security Copilot AgentiLink Systems, Inc.

Domain Spoofing Security Copilot Agent

iLink Systems, Inc.

Domain Spoofing Security Copilot Agent

iLink Systems, Inc.

Domain Spoofing Security Copilot Agent
iLink Systems, Inc.