Managing AD impersonation detection rules using the CLI

After the AD synchronization script completes its initial run, you can use the Email Security - Server appliance CLI to configure AD sender impersonation detection rules by adding AD group names.

Prerequisites

You have administrator access to the Email Security - Server appliance.
You have the objectGUID of each AD group whose users you want to add to the impersonation rules check.
The AD synchronization script has completed its first run.
See Starting the AD synchronization script using the Web UI on .
Note
The appliance Web UI does not display the AD synchronization progress or status.

To manage AD sender impersonation detection rules using the CLI:

Go to configure mode.

hostname > enable
hostname # configure terminal

To add all the users from an AD group to a sender impersonation detection rule, use the following command, where <group uuid > is the objectGUID for the AD group:
email-analysis impersonation o365 group-id <group-uuid>
To show all AD sender impersonation detection rules, use the following command:
show email-analysis impersonation ad-group all
To remove an AD sender impersonation detection rule, use the following command, where <rule-id > is the identifier for the AD impersonation rule:
```
no email-analysis impersonation o365 rule-id <rule-id>
```
After you remove an AD sender impersonation detection rule, the appliance no longer checks for sender impersonations of the users who were in those AD groups.
Save your changes.
hostname (config) # write memory