Misaddressed Email Protect - FAQ

This article lists Frequently Asked Questions relating to Misaddressed Email Protection (MEP), which assists end-users in preventing emails from being sent to the wrong recipient.

It is recommended to have CyberGraph in a Learning state for two weeks and then progress to an On state before setting a Misaddressed Email Protect policy. Doing so will feed the CyberGraph learning algorithms enough historical data to make more accurate policy matches and hone their accuracy. Customers already utilizing CyberGraph for at least this period will have the algorithmic data available for Misaddressed Email Protection to use immediately.

Q:	What is required to use MEP?
A:	Misaddressed Email Protection’s includes OUTBOUND emails. As such, the following is required for the customer to utilize this functionality: CyberGraph: The machine learning capabilities of Misaddressed Email Protection leverage CyberGraph’s name-learning mechanisms. Threat Remediation (partial features included with CyberGraph): This allows Mimecast to remediate messages sent internally that include misaddressed emails.
Q:	How can I access the ‘Misaddressed Email Protection’ Settings?
A:	Navigate to Mimecast Administration Console | Services | Misaddressed Email Protection.
Q:	Does this feature work for Internal-to-External and internal-to-internal?
A:	We will not run MEP if it is an internal email.
Q:	Is IEP (Internal Email Protect) required to utilize the ‘MEP Clawback' feature for internal-to-internal emails?
A:	No. Suppose IEP is not included in your package. In that case, Threat Remediation will still be visible with a READ-ONLY view with the only option to enable Misaddressed Email Protection within the Threat Remediation Settings.
Q:	Why can't we stop Internal-to-Internal emails from being sent?
A:	Internal-to-internal emails do not get processed through the Mimecast Gateway. We cannot stop the internal email but can utilize IEP to remediate the email from a user's inbox.
Q:	Is branding supported?
A:	Yes
Q:	Does MEP trigger on email headers?
A:	When determining which messages to send to CyberGraph for MEP evalutation, MEP triggers before data acceptance and only scans the envelope address. Once received by CyberGraph, matching rules are run based on the message recipient header. Please refer to the MEP Administration guide for more information.
Q:	What is the "relationship strength" in considering MEP policies against a user?
A:	Please refer to the MEP Administration guide regarding Relationship Strength for more information.
Q:	Does MEP work with any sender application/environment?
A:	Yes. MEP is sender-agnostic. It will trigger if sent from any source that hits the Mimecast gateway. This includes the Mimecast Personal Portal (MPP).
Q:	Can MEP be scoped to specific individuals or groups?
A:	Yes. During the policy creation, administrators can select either a group or user(s).
Q:	Can the 'Automatically Send' feature be configured?
A:	Yes. This time can be configured during the policy creation.
Q:	Can administrators prevent an MEP-flagged email from being sent?
A:	Yes. Within the MEP dashboard, administrators can view emails that are currently queued up and have yet to reach the Auto Release time. Administrators can choose to Drop or Release these emails.
Q:	What happens if a user acts on the MEP notification and then changes their mind? Can they choose the other action?
A:	No. Once a message is actioned, returning to the notification and selecting another option will present a page indicating the message has already been actioned.
Q:	Should I use a "No Action (Audit)" policy action first?
A:	Yes. MEP utilizes machine learning, and it is important to allow a learning process for at least two weeks before allowing MEP to take action.
Q:	Can Mimecast expand a Distribution List to see potentially misaddressed emails?
A:	No.
Q:	Does Mimecast archive a message that was dropped that MEP flagged?
A:	No. Message acceptance does not occur in these instances as we trigger/scan on the initial metadata information provided.
Q:	Does MEP stop an email from being sent to all addressed recipients if only one address is flagged?
A:	Yes.
Q:	Are Sub-Domains treated differently?
A:	No. MEP will only trigger based on the primary domain and the address in question.
Q:	If an email is sent/released, can MEP trigger that email address again?
A:	Possibly. Please consult the MEP Administrator Guide for details on Relationship Strength, which determines whether a subsequent message is held.
Q:	How long are MEP logs saved for?
A:	30 days.
Q:	Will the MEP delay be displayed within transmission data?
A:	Yes. See the below example: