CyberGraph 2.0 - Trackers

This page describes CyberGraph's Image Tracker Removal feature. 

Overview

The Image Tracker Removal feature protects customers against the following exploit: 

A sender can add a variety of trackers to images embedded in emails. These trackers are used to gather various data about a recipient’s device and their message engagement. While some of this data gathering is relatively harmless, some can be malicious. Spammers or other bulk marketers can use the information to create follow-up promotional messages, which is not harmful. However, attackers can gather information as input to a spearphishing attack. Thus, it is valuable to hide user information and activity from such senders. The descriptions of various types of trackers can be found in the section below.

Embedded pixels are the most common type of tracking. When a recipient opens a message that contains a 1px x 1px embedded pixel, a request is made to a remote server to download the pixel. When the request is made, information (e.g., the user's IP address) is used to reveal the user's location, information about the device used to open the message, operating system/software version, and browser information is sent back to the remote server. 

The CyberGraph Tracker feature finds and removes original images from CyberGraph-processed emails and rehosts them at a safe Mimecast storage location, thus hiding the actual user interaction from the sender and thwarting data collection.  This rehosting is transparent to end users - they should not notice a difference. 

Tracker rehosts all inbound mail images - benign and malicious - for consistency and these are downloaded automatically with the message. The images are rehosted by Mimecast for 180 days, after which time, viewing the email will return the original image.  

If you have Image Downloads Disabled for external emails, CyberGraph overrides this setting.

 

As part of this feature, Tracker Dashboards provide a history of Tracker removal activity for CyberGraph Administrators (see The Dashboard for further information). In addition, Administrators can subscribe to weekly email reports that provide several metrics about Tracker activity, as well as a link to the Administration Console dashboard with more information. The metrics in the email are the same as those in the dashboard - there is no additional information provided in the emails.  

Search

The Tracker Search page allows you to search for specific Tracker Detection details. To Search for Dynamic Banners, fill in the following details after navigating to CyberGraph | Trackers | Search within the Mimecast Administration Console.    

To search for tracker details, select: 

1. Date range: This can be:

• • • Past 24 hours
    • Past 7 days
    • Past 30 days
    • Custom Range (Select Start and End Date)

The Date range default is set to past 24 hours, and the Custom Range cannot exceed 90 days.

2. Condition: This can be either: 

• • • Sender
    • Recipient
    • Subject

3. Operator: This can be either: 

• • • Contains
    • Equal to

4. Value: Enter the search data to correspond with the previous fields. 
5. Criteria: This can be used to add additional search criteria. There is no limit on the amount of criteria that can be added. 

All Search Data will be available for export by selecting Export Data once the results are generated, which will then be available to view, download, or remove from the Exports Tab. This data includes the following: 

• • • Date & Time
    • User
    • Criteria 
    • Date Range 
    • Status 

To remove or download, select the three-dot icon next to the Status field and select the appropriate option.