Configuring the Phishing Watch

To use the Phishing Watch feature, use the Phishing Watch Manager page to create phishing watch snippets, then deploy them on all company web pages that may be used for phishing attacks.

After a snippet is created, you can use the Phishing Watch Manager page to edit, delete, and monitor the snippet status.

This feature is described in Phishing Watch.

temporary placeholder

Access to the Phishing Watch Manager can be enabled for analyst users, from the Permissions tab on the Settings > Users page.

The Phishing Watch Manager shows details about protected domains and snippets:

  • Protected domains purchased - The amount of domains that can be protected with the Phishing Watch feature. You can create snippets for pages within a protected domain.
  • Snippets used - The total amount of unique snippets that have been created.

Create a Phishing Watch snippet

It is best practice to create a unique snippet for every web page you want to track.
This granularity enables you to define different whitelisted domains for every web page so you can focus only on real results. Moreover, you will be able to monitor the status of each individual snippet so you can ensure that the service is up and running in every webpage.

To create a new snippet:

  1. Select Threat Command > Configurations > Phishing Watch Manager.
  2. Click temporary placeholder on the bottom right corner of the page.
    The Generate New Snippet dialog is displayed.
    temporary placeholder
  3. Type the Target URL, the web page in which the snippet will be installed.
  4. (Optional) Type a descriptive name to easily identify this snippet.
  5. (Optional) Type one or more Excluded domains, domains from where the redirection originates from a trusted source.
    Be sure to list all of the legitimate domains which redirect to your target URL, in order to avoid generating false positive threats.
  6. Click Generate.
    The downloading process will start automatically.

The newly created snippet is now shown in the Existing Phishing Watch snippets table.

  1. Repeat this process for every snippet to be generated.

After creating a snippet, it must be deployed, as described in the following section.

After a snippet is created, you can download, edit, or delete it. These options are available when you hover the pointer over the snippet line in the table.

Deploy a Phishing Watch snippet

The snippet can be deployed in the following ways:

  • Within the web page source code (static deployment).
  • Embedded inside known frontend code frameworks (dynamic deployment), similar to the implementation of Google Analytics (for example, Angular, React.JS, Vue.JS).
  • Another option is using third-party injection services (e.g., Cloudflare, F5, Akamai). For more information, contact Customer Support.

The following installation examples show how to deploy the Phishing Watch snippet within web pages that might be used for a phishing attack. This usually includes any non-authenticated pages that contain user input elements, such as login pages, “contact us” pages, etc.

To deploy the snippet on a static website:

  1. Following the download of the JavaScript file, copy its entire contents.
  2. Paste the contents before the closing </body> tag on any of your site trackable pages, as seen in the following example:
    temporary placeholder

To deploy the snippet on a dynamic website:

  1. Following the download of the JavaScript file, copy its entire contents.
  2. Locate the global site tag for your property.
  3. Paste your global site tag into its own include or component files.
  4. Link the include or component file so that the snippet appears before the closing </body> tag on every webpage you want to track.
    The following figure illustrates an example in the Angular environment:
    temporary placeholder

Note: the component needs to be loaded on the framework.

For more information, contact Customer Support.

Monitor Phishing Watch status

A monitoring health check is performed against each existing snippet within the provided Target URL and its status is determined accordingly. The existing snippet status is shown in the Status column of the Phishing Watch Manager page.

Tip: You can copy the target URL with the copy button in the Target URL column (visible when you hover).

To refresh the status of a Phishing Watch snippet:

  • Click temporary placeholder in the snippet row in the Existing Phishing Watch snippets table.

The following table describes the meaning of the Phishing Watch snippet status:

StatusMeaningRequired Action
OKThe snippet is functioning correctlyNo action required
Website is not accessibleThe provided “Target URL” is inaccessible- Check if the website within the provided “Target URL” is online- Check if the provided “Target URL” is properly formatted
Snippet is not installedThe snippet was not found in the provided “Target URL”Check if the snippet is properly installed in the provided “Target URL”
Snippet ID mismatchThe monitoring service was expecting to monitor snippet X within the provided “Target URL”, but snippet Y was detected insteadMake sure that the correct snippet was installed in the provided “Target URL”
Old versionThe installed snippet’s version is out of dateDownload a new version using the “Download new version” button
PendingThe snippet has recently been created and the monitoring process needs to perform a health checkWait for the monitoring health check to complete
Pending verificationShown upon clicking the “Verify status” icon
A health check is currently being performed
Wait for the monitoring health check to complete