Configuring the Phishing Watch

To use the Phishing Watch feature, use the Phishing Watch Manager page to create phishing watch snippets, then deploy them on all company web pages that may be used for phishing attacks.

After a snippet is created, you can use the Phishing Watch Manager page to edit, delete, and monitor the snippet status.

This feature is described in Phishing Watch.

Access to the Phishing Watch Manager can be enabled for analyst users, from the Permissions tab on the Settings > Users page.

The Phishing Watch Manager shows details about protected domains and snippets:

• Protected domains purchased - The amount of domains that can be protected with the Phishing Watch feature. You can create snippets for pages within a protected domain.
• Snippets used - The total amount of unique snippets that have been created.

Create a Phishing Watch snippet

It is best practice to create a unique snippet for every web page you want to track.
This granularity enables you to define different whitelisted domains for every web page so you can focus only on real results. Moreover, you will be able to monitor the status of each individual snippet so you can ensure that the service is up and running in every webpage.

To create a new snippet:

1. Select Threat Command > Configurations > Phishing Watch Manager.
2. Click on the bottom right corner of the page.
   The Generate New Snippet dialog is displayed.
   
3. Type the Target URL, the web page in which the snippet will be installed.
4. (Optional) Type a descriptive name to easily identify this snippet.
5. (Optional) Type one or more Excluded domains, domains from where the redirection originates from a trusted source.
   Be sure to list all of the legitimate domains which redirect to your target URL, in order to avoid generating false positive threats.
6. Click Generate.
   The downloading process will start automatically.

The newly created snippet is now shown in the Existing Phishing Watch snippets table.

1. Repeat this process for every snippet to be generated.

After creating a snippet, it must be deployed, as described in the following section.

After a snippet is created, you can download, edit, or delete it. These options are available when you hover the pointer over the snippet line in the table.

Deploy a Phishing Watch snippet

The snippet can be deployed in the following ways:

• Within the web page source code (static deployment).
• Embedded inside known frontend code frameworks (dynamic deployment), similar to the implementation of Google Analytics (for example, Angular, React.JS, Vue.JS).
• Another option is using third-party injection services (e.g., Cloudflare, F5, Akamai). For more information, contact Customer Support.

The following installation examples show how to deploy the Phishing Watch snippet within web pages that might be used for a phishing attack. This usually includes any non-authenticated pages that contain user input elements, such as login pages, “contact us” pages, etc.

To deploy the snippet on a static website:

1. Following the download of the JavaScript file, copy its entire contents.
2. Paste the contents before the closing </body> tag on any of your site trackable pages, as seen in the following example:
   

To deploy the snippet on a dynamic website:

1. Following the download of the JavaScript file, copy its entire contents.
2. Locate the global site tag for your property.
3. Paste your global site tag into its own include or component files.
4. Link the include or component file so that the snippet appears before the closing </body> tag on every webpage you want to track.
   The following figure illustrates an example in the Angular environment:
   

Note: the component needs to be loaded on the framework.

For more information, contact Customer Support.

Monitor Phishing Watch status

A monitoring health check is performed against each existing snippet within the provided Target URL and its status is determined accordingly. The existing snippet status is shown in the Status column of the Phishing Watch Manager page.

To refresh the status of a Phishing Watch snippet:

• Click  in the snippet row in the Existing Phishing Watch snippets table.

The following table describes the meaning of the Phishing Watch snippet status: