Skip to content
Have I Been Squatted logo Have I Been Squatted logo Have I Been Squatted Docs

Email Intelligence guide

Email Intelligence adds mail-observed domain signals to Have I Been Squatted. Connected providers send normalized email telemetry facts, which are matched against monitored domains and lookup results. The feature is designed for earlier domain discovery, especially when abusive sender domains appear in mail before they appear in registration, certificate, or passive DNS workflows.

Email Intelligence currently supports Microsoft 365 and Google Workspace ingestion. Microsoft 365 also supports Watchdog, an optional response capability that can add sender blocks to the Microsoft Tenant Allow/Block List.

Microsoft 365 Email Intelligence integration

What the feature supports

Section titled “What the feature supports”
  • Email telemetry ingestion: Poll Microsoft Defender Advanced Hunting or Google Workspace Gmail audit logs for domain-level mail facts
  • Provider attribution: Mark lookup results as discovered through email telemetry, including provider and evidence source
  • Dashboard analysis: Review recent message, URL-domain, and attachment-metadata observations alongside email-sourced lookup results
  • Observation review: Inspect messages, URL domains, attachment metadata, and response activity in focused views
  • Microsoft 365 Watchdog: Optionally add high-confidence sender-domain blocks to Exchange Online through the Tenant Allow/Block List

Data boundary

Section titled “Data boundary”

Email Intelligence stores privacy-bounded facts rather than raw mailbox data. Stored events include provider, observation time, event type, direction, sender domains, recipient domains, URL domains, attachment metadata, matched monitored domains, and hashed provider identifiers.

The ingestion pipeline intentionally excludes raw provider payloads, message subjects, local parts, full email addresses, message bodies, and full uniform resource locators (URLs). Message and event identifiers are hashed before storage.

Provider-specific behavior:

  • Microsoft 365: Reads Microsoft Defender Advanced Hunting message, URL, and attachment metadata. URL observations store the domain and provider-reported location rather than the full URL. Attachment observations store available file type, size, hashes, and threat-detection metadata rather than filenames or file contents.
  • Google Workspace: Reads Google Workspace Admin software development kit (SDK) Reports application programming interface (API) Gmail delivery audit events. Candidate domains can come from sender and header fields, plus link-domain audit fields when Google exposes them, but stored events remain domain-level facts.

Provider setup

Section titled “Provider setup”

Microsoft 365

Section titled “Microsoft 365”

Open Integrations > Microsoft 365 Email Intelligence.

Enable one or both capabilities:

  • Email ingestion: Uses Microsoft Defender Advanced Hunting. Requires ThreatHunting.Read.All.
  • Watchdog: Uses Exchange Online application access to create sender blocks. Requires Exchange.ManageAsApp.

Choose Connect tenant or Reauthorize, then complete the Microsoft administrator consent flow. The toggles in Have I Been Squatted control which capabilities run after connection.

When Watchdog is enabled, review the Protected domains list before connecting or saving. Domains in this list are never pushed into the Tenant Allow/Block List, even if a lookup result or rule later marks them as malicious.

Google Workspace

Section titled “Google Workspace”

Open Integrations > Google Workspace Intelligence.

Enable Gmail audit logs, then connect with a Google Workspace administrator account. The Open Authorization (OAuth) flow requests Admin SDK Reports audit access for Gmail delivery events. Reconnect if the integration status indicates permission loss, no usable refresh token, or a source authorization error.

Google Workspace ingestion contributes email-observed domains and message observations. Watchdog response is currently Microsoft 365 only.

How email-sourced lookup results work

Section titled “How email-sourced lookup results work”

Email ingestion proposes candidate domains from provider telemetry. Have I Been Squatted then applies conservative matching before adding email attribution to lookup results:

  1. Monitored domains and their subdomains are not treated as suspicious candidates.
  2. Existing lookup results are updated first, so email evidence is attached to the current result when possible.
  3. New candidates are matched against monitored domains by recipient-domain ownership or a unique close-domain match.
  4. Ambiguous matches are skipped instead of being assigned to the wrong monitored domain.
  5. A completed lookup must exist for the monitored domain before new email-sourced results can be inserted.

When a candidate is accepted, the result appears alongside normal lookup results with an email source marker.

Lookup result with Microsoft Defender email source

The result can still use the normal rules engine, tags, alerts, exports, and investigation workflows. The main difference is provenance: the domain was observed in connected mail telemetry.

Dashboard

Section titled “Dashboard”

Open Email Intelligence from the application sidebar to review the operational view.

The Overview summarizes the last 14 days:

  • Message observations: Normalized email message events ingested from connected providers
  • URL observations: Microsoft 365 URL-domain observations linked to message telemetry
  • Attachment observations: Microsoft 365 attachment metadata linked to message telemetry

The Overview uses the same 60-day message-activity timeline as the focused views, alongside compact URL and file summaries and recent email-observed lookup results. Selecting a day opens the corresponding Emails view. Email-sourced lookup rows link back to the relevant monitored-domain lookup results.

Dedicated Emails, URLs, and Files views separate message activity from Microsoft 365 URL-domain and attachment-metadata observations. Each view includes 14-day summary metrics, a 60-day activity timeline, focused characteristics, and privacy-bounded rows. Google Workspace currently contributes message telemetry only.

Emails view

Section titled “Emails view”

The Emails view shows 14-day message metrics and breakdowns, followed by normalized message and Watchdog response facts for a selected Coordinated Universal Time (UTC) day.

Email Intelligence Emails view

Each row includes the observation time, event type, provider, direction, available sender and recipient domains, hashed message correlation identifier, linked monitored domains, and response outcome. URL and attachment observations remain available in their dedicated views.

Depending on the event type, observation details include:

  • Message: Sender and recipient domains
  • Quarantine push: Microsoft Watchdog action and result

Use this view when validating message ingestion, reviewing sender and recipient context, or inspecting Watchdog response activity.

Watchdog behavior

Section titled “Watchdog behavior”

Watchdog is a Microsoft 365 response capability. It does not block every email-observed domain. It evaluates lookup results after enrichment, then creates a Microsoft sender block only when the result passes safety checks and high-confidence heuristics.

Watchdog skips:

  • Domains tagged as owned, ignored, or false positive
  • The monitored domain itself
  • Domains configured as protected
  • Domains that do not meet the current high-confidence rule
  • Domains already present as allowed or blocked in the Tenant Allow/Block List

Current high-confidence conditions require a recent registration and at least one strong signal, such as high phishing classification, selected risky registrar evidence, or a mail exchange (MX)-only mail setup matching the configured provider heuristic. Sender blocks expire after 30 days by default. A single run is capped at 100 pushed sender blocks.

Common checks

Section titled “Common checks”

No dashboard data

Section titled “No dashboard data”
  • Confirm at least one email provider is connected and enabled.
  • For Microsoft 365, confirm ingestion is enabled and the integration has ThreatHunting.Read.All.
  • For Google Workspace, confirm Gmail audit logs are enabled and the source status is connected or no-data.
  • Confirm monitored domains have completed lookups. Email candidates are attached to existing monitored-domain workflows.
  • Allow for provider ingestion delay. The service polls a bounded recent window rather than reading mail synchronously.

Watchdog is not pushing blocks

Section titled “Watchdog is not pushing blocks”
  • Confirm Watchdog is enabled for Microsoft 365.
  • Confirm Exchange.ManageAsApp is present.
  • Confirm the candidate is not owned, ignored, false positive, monitored, or protected.
  • Confirm the lookup result passes the high-confidence heuristic.
  • Check whether the domain is already allowed or blocked in the Microsoft Tenant Allow/Block List.

Disconnecting a provider

Section titled “Disconnecting a provider”

Deactivate the integration in Have I Been Squatted to stop ingestion and Watchdog processing. To remove provider-side access completely, also revoke the application grant in Microsoft Entra Enterprise Applications or Google Workspace admin settings.