CyberGraph 2.0 - Rules

This guide lists the CyberGraph 2.0 Rules, the associated banner messages, and their meaning. The rules are color-coded into the following categories:

Informational Rules

The following rules are displayed in a Blue banner:

Rule	Banner Message	Single Recipient	Banner Meaning
FirstGroupInboundCommRule	This is their first mail to some recipients.	This is their first email to you.	This is the first email from this sender to certain recipients.
FirstGroupOutboundCommRule	Some Recipients have never replied to this person.	You've never replied to the recipient.	Certain recipients have never emailed or replied to the email.
FirstCompanyInboundCommRule	This is their first email to your company.	This is their first email to you.	The sender has never emailed you or your company.
FirstCompanyOutboundCommRule	No employee has ever replied to this person.	You've never replied to this person.	The sender may have emailed you or your company, but no one at your company has previously sent an email to this sender.
RecipientInclusionRule	Somebody new is included in this email.	Somebody new is included in this email.	A new recipient, including any BCC recipient, has been added to the email thread. This rule is triggered only for messages responding to emails originating from external mail. Note: This rule is off by default, as it can override strong communication patterns.
PersonalEmailRule	This is a personal email address.	This is a personal email address.	The sender's address comes from a personal email address (e.g., Gmail, Yahoo, Hotmail).
PunyEmailRule *	This person's address has non-English characters.	This person's address has non-English characters.	The sender's email address contains non-English characters.
PunyNameRule *	This person's name has non-English characters.	This person's name has non-English characters.	The sender's display name contains non-English characters.
PunySubjectRule *	The subject has non-English characters.	The subject has non-English characters.	The subject contains non-English characters.

Rules marked with "*" are disabled by default but may be enabled if desired.

See this external article for an explanation of Punycode (these characters can be used in homograph attacks).

Warning Rules

The following rules are displayed in an Amber banner:

Rule	Banner Message	Single Recipient	Banner Meaning
SimilarNameWithinCompanyRule	Similar name to someone in your company.	Similar name to someone in your company.	The sender is external, but their name is similar to another person in your company.
SimilarNameDifferentEmailRule	Similar name to someone you've contacted.	Similar name to someone you've contacted.	The sender has a name similar to somebody you've emailed before.
SPFRecordExistsRule *	The sender's email address couldn't be verified.	The sender's email address couldn't be verified.	There is no SPF record for the sending domain.
SPFSenderFailedRule *	The sender's email address couldn't be verified.	The sender's email address couldn't be verified.	The SPF record for the sender's domain doesn't include the IP address of the server sending the message.
AddressLengthRule	The sender's address is unusually long.	The sender's address is unusually long.	The sender's email address has over 70 characters. This can be deliberate to prevent you from seeing the domain.
PersonalInternationalEmailRule	This is an obscure personal email address.	This is an obscure personal email address.	The sender's email address comes from a personal email account (e.g., Gmail, Yahoo, Hotmail). It may have a country domain (.il, .ru, etc.) and may have non-English characters.

Rules marked with "*" are disabled by default but may be enabled if desired

Critical Rules

The following rules are displayed in a Pink banner: 

Rule	Banner Message	Single Recipient	Banner Meaning
YoungDomainRule	The domain was created recently.	The domain was created recently.	The sender's domain was created less than three months ago.

Reported Rules

The following rules are displayed in a Red banner:

Rule	Banner Message	Single Recipient	Banner Meaning
BlacklistedDomainRule	This domain was marked as dangerous.	Do not click any links or respond.	This domain was marked as dangerous. Do not click any links or respond. The sender's domain has been reported as potentially malicious.
BlacklistedAddressRule	This sender was marked as dangerous.	Do not click any links or respond.	This sender was marked as dangerous. Do not click any links or respond. The sender's email address has been reported as sending potentially malicious emails.

Misaddressed Email Protect

The following rules govern the Misaddressed Email Protect feature.

Rule	Rule Meaning
MisaddressedRecipientRule	This message may not have been intended for the entered recipient.
MisaddressedPersonalRule	This message is directed to a personal mail account and may not have been intended for the entered recipient.