If you’re an IT admin, MSP, or the unlucky soul who got “cybersecurity” added to their job description, you know email threats are relentless. Phishing, malware, business email compromise—they’re not going away. If you want real protection (without turning your inbox into a spam graveyard), setting up proper automated threat detection is a must.
This guide walks you through setting up automated detection in Emailguard step by step. No vague promises—just practical steps, with a few honest takes about what works, what’s overkill, and what actually matters.
1. Get Your Bearings: What You Need Before You Start
Before you start clicking around, make sure you have:
- Admin access to your Emailguard portal.
- Access to your email platform’s admin console (Microsoft 365, Google Workspace, or whatever you use).
- A basic inventory of your domains and mailboxes.
- Around 30–60 minutes set aside. The setup isn’t hard, but you’ll want to do it right.
Pro tip: If your organization has weird email routing (on-prem servers, third-party relays, etc.), map that out first. It’ll save you pain when configuring connectors.
2. Step One: Connect Emailguard to Your Email Platform
The first real step is to get Emailguard talking to your actual email system. Here’s how:
A. Log in and Find the Integration Section
- Log into your Emailguard admin dashboard.
- Look for the “Integrations” or “Email Platforms” section. (If you don’t see it, double-check your permissions.)
B. Choose Your Platform and Start the Connector Setup
- Select your email provider (e.g., Microsoft 365, Google Workspace).
- Click “Add Connector” or “Set Up Integration.”
What actually happens here?
You’ll grant Emailguard permission to scan messages and (if you choose) take automated actions like quarantining or deleting threats.
C. Grant Permissions (Yes, It’ll Ask for a Lot)
- You’ll be redirected to your provider’s consent page.
- Review the permissions. Emailguard asks for wide access (read, write, manage mailboxes). If you’re queasy about that, you’re not alone—most email security tools need broad access to work. Minimize what you can, but don’t cripple core scanning features.
- Approve the integration.
D. Verify the Connection
- Back in Emailguard, you should see a “Connection Successful” message.
- If not, check for:
- Wrong admin account (use a global or super admin, not a regular user).
- MFA/SSO hiccups—sometimes you need to approve extra prompts.
- Firewall or API restrictions on your email platform.
Ignore:
“Optional” steps for advanced routing or connectors unless you have a non-standard setup. If your email is cloud-hosted and straightforward, stick to the basics for now.
3. Step Two: Set Up Your Detection Policies
This is where the magic (or mess, if you overdo it) happens.
A. Go to the Threat Detection or Policies Tab
- Look for “Threat Detection,” “Policies,” or “Rules.”
B. Choose a Starting Policy Template (Or Make Your Own)
Most folks should start simple:
- Pick the baseline “Recommended” or “Default” policy. Emailguard’s out-of-the-box rules catch most generic threats—phishing, malware, spoofing.
- Don’t try to write custom rules for every scenario unless you have a real reason.
What works:
Letting the default engines do their thing first, then tuning based on real detections.
What doesn’t:
Going full “paranoid mode” on day one. Overly strict rules will annoy users, create false positives, and make you the enemy of your own helpdesk.
C. Review and Adjust Sensitivity Levels
- Check the slider or settings for “Aggressiveness,” “Sensitivity,” or similar.
- Start in the middle (or just above).
- Move to “High” only if you’re in a high-risk industry or have a history of targeted attacks.
- Avoid “Maximum” unless you enjoy false alarms.
D. Enable Real-Time and Scheduled Scanning
- Turn on “Real-Time Scanning” for inbound and internal mail. This flags threats as soon as they hit.
- If your license includes it, enable “Scheduled Scans” to sweep mailboxes for threats missed in the past.
E. Decide What Happens to Detected Threats
- Choose your action: Quarantine, Delete, Flag, or Move to Junk.
- Start with “Quarantine” so you can review what’s caught—don’t let Emailguard auto-delete until you trust the system.
- Set up notifications for admins (and optionally, users) about quarantined threats.
Pro tip:
Don’t alert end users for every blocked message. Save user notifications for when they need to take action (e.g., release from quarantine), or you’ll train everyone to ignore important warnings.
4. Step Three: Set Up Alerting and Reporting
Automation only helps if you actually know when there’s a problem.
A. Set Who Gets Alerts—and How
- Go to “Notifications” or “Alerting.”
- Add security admins, IT leads, or whoever needs to know.
- Set up notifications for:
- Detected high-severity threats.
- Policy changes.
- Integration failures.
What to ignore:
Daily “summary” emails. They’re just noise. Focus on real-time alerts for real issues.
B. Set Up (or Skip) End User Alerts
- Only turn on user alerts for actionable events (like when a legit message is quarantined).
- Otherwise, keep alerts admin-only at first. You can always loosen this later.
C. Schedule Regular Reports
- Set up weekly or monthly summaries for yourself or management.
- Don’t obsess over these—just scan for trends or spikes.
Pro tip:
Export a CSV or PDF of threats caught in the first month. It’s the best ammo against budget skeptics.
5. Step Four: Test Your Setup (Don’t Skip This)
You’d be surprised how often people skip testing and then find out nothing’s working when a real threat hits.
A. Send Test Threats
- Use Emailguard’s built-in test tools to simulate phishing, malware, and spoofing attempts.
- Or, if you’re brave, use a test message from a service like GTUBE (for spam) or EICAR (for viruses).
B. Confirm Detection and Action
- Make sure test threats are detected and quarantined.
- Check that you (and only you) get the proper alerts.
C. Check False Positives
- Review the quarantine for legit messages that got snagged.
- If you see important business emails in there, dial your sensitivity down or whitelist trusted senders.
D. Document What You Changed
- Note which policies you adjusted and why.
- Keep a record—it’ll save you headaches if you need to troubleshoot later.
What works:
Running a few tests every time you tweak the rules. Don’t just “set and forget.”
6. Step Five: Tune and Maintain
Automated detection isn’t “set it and walk away.” You need to check in now and then.
A. Review Detections Weekly (At First)
- For the first month, check the quarantine and alert logs weekly.
- Look for:
- Missed threats (false negatives)
- Good emails caught by mistake (false positives)
B. Whitelist and Blacklist
- Add key partners, domains, or services to your whitelist if their emails keep getting flagged.
- Don’t go overboard—every exemption is a risk.
C. Adjust Policies Based on What You See
- Tighten or loosen sensitivity based on real results, not guesses.
- Update rules for new threat types if your users get targeted.
D. Stay on Top of Updates
- Emailguard will push out new detection engines and threat signatures—make sure automatic updates are enabled.
- Read release notes when you can, but don’t panic about every new feature.
Honest Takes: What to Skip, What to Watch
- Don’t buy into the “AI will stop everything” hype. Automated detection is great, but attackers adapt. You’ll need to tweak settings and stay alert.
- Ignore fancy dashboards unless you have time to dig into the data. Stick to actionable alerts.
- Don’t overload users with warnings. You want them to trust the system, not tune it out.
- Cloud-only? You don’t need legacy routing or on-prem connectors. Don’t let the setup wizard scare you.
Wrapping Up: Keep It Simple, Iterate Often
Setting up automated threat detection in Emailguard isn’t rocket science, but it pays to do it right—and revisit your setup regularly. Start with the basics, test, and tune as you go. Don’t get distracted by shiny features or “next-gen” claims. The goal is less manual work and fewer threats in your inbox—not a science project.
Stick with it, keep things simple, and adjust as real-world threats pop up. That’s how you get actual security—not just another box checked.