Skip to main content

Responses are generated using AI and may contain mistakes.

CollectorsCloud Collectors Administration Guide

Table of Contents

Prerequisites to Configure the Phishing Email Inbox Cloud Collector

Before you configure the Phishing Email Inbox cloud collector you must complete the following prerequisites:

Create and Register a Microsoft Entra ID Application

  1. Log into your Azure account by accessing the Azure portal.

  2. From the available Azure Services, select Microsoft Entra ID.

    ms-entra-id.png

  3. From the left navigation pane, select App Registrations, then click New registration.

  4. On the Register an application page, enter the following information:

    • Name – Specify a name for the new application. For example, Exabeam MS Entra ID App.

    • Supported account types – Select the account type Accounts in this organizational directory only.

    • Redirect URI – (Optional) Select the Web platform and specify a URI.

  5. Click Register. When registration is complete, the Overview tab of the new application is displayed.

    azure-ad-app-overview.png

  6. Copy and make a note of the values for both the Application (client) ID and the Directory (tenant) ID. You will need these values when configuring a cloud collector.

Assign API Permissions

Use the following steps to assign the required permission to the Microsoft Entra ID application.

  1. In your new Microsoft Entra ID application, click API permissions in the left navigation pane.

  2. Click Add a permission.

  3. In the Request API permissions pane on the right, click the APIs my organization uses tab.

  4. Use the search field to find and select a Office 365 Exchange Online.

  5. Click Application permissions to expand the permission selections.

  6. In the permissions search bar, search for and expand a specific set of permissions. In the expanded options, select the permissions you need. For the Phishing Email Inbox cloud collector, select IMAP.AccessAsApp.

    phishing_email_prerequisite_1.png

  7. Click Add permissions. The new permission is added to the application.

  8. Provide admin consent for all application permissions. Then, register the application's service principal in Exchange Online by running these PowerShell commands for Installing ExchangeOnline.

    Install ExchangeOnlineManagement
Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser
Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline

  9. Run the following command to check if IMAP is enabled for the email address.

    Get-CASMailbox -Identity <email_address> | Select IMAPEnabled

    For example, Get-CASMailbox -Identity [email protected] | Select IMAPEnabled

  10. Run the following command to register Service Principal in Exchange. Enter the App ID and the Service ID in the command. The App ID is the client ID and the Service ID is the Object ID from enterprise application.

    New-ServicePrincipal -AppId e123456a-1234-11dd-1234-1234a65d11ad -ServiceId 1234f11e-afc2-1234-aa11-77fd4ad11c30
     Get-ServicePrincipal | fl
    Add-MailboxPermission -Identity "[email protected]" -User 0117f11e-afc3-1234-aa88-11fd1ec54c10 -AccessRights FullAccess

Generate Certificates and Secrets

  1. In your new Microsoft Entra ID application, click Certificates & secrets in the left navigation pane.

  2. Use the authentication method OAuth2 and select the Client secrets tab, and continue with the next step.

  3. On the Client Secrets tab, click New client secret and do the following:

    1. Enter a Description and an Expires term for the secret.

    2. Click Add. The new client secret is displayed on the Client secrets tab.

    3. Copy and make a note of the Value. You will need this client secret value when you configure a Microsoft cloud collector. You will not be able to recover this value later if you don't make a note of it.

      azure-ad-secret.png

Grant Administration Consent

When all of the API permissions have been created, the configured permissions table should look like the image below. Notice that the Status for each new permission is Not granted.

In order for a Phishing Email Inbox cloud collector to pull data from these data sources, you must grant administration consent for each API permission as follows:

  1. Above the configure permissions table, click Grant admin consent.

  2. When prompted to confirm, click Yes. The Status for each permission changes to Granted.

    ms-graph-all-permissions-granted.png

Obtain the App Password for Gmail

Use the following steps to obtain app password for configuring the Phishing Email Inbox cloud collector with the mailbox type Gmail.

  1. Access myaccount.google.com and navigate to your Google Account Setting page.

  2. In the left pane, click Security & sign-in.

  3. Enable 2-step verification and scroll to the App passwords section.

  4. Specify a name for the app and click Create.

    A password is generated and displayed on a pop-up box. Record the password for later use.