> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/about-integrations/about-mdr-for-email.md).
# About MDR for Email
## Scope and Limitations
* The service can be used with any email provider, however if you have an email provider *other than* Google Workspace or Microsoft 365, certain actions like message trace, search for other recipients, and auto remediation will not be available.
## MDR for Email vs Managed Phishing
Both of these services are intended to protect you against phishing emails, however the method and scope of ingestion differs.
* **MDR for Email** monitors your existing email security tools and ingests their alerts (we do not ingest the email itself). This service is powered by automatic monitoring of alerts via a Workbench integration to one of the [supported email security tools](#h_01jrjp0rrksnyqz3skccjvv8kd).
* [**Managed Phishing** ](/more-features/expel-managed-phishing.md)monitors user submissions of suspected phishing emails and ingests the entire email text, attachments, full metadata, .eml files, etc. This service is powered by human submissions of suspected phishing emails (via a submission button that we add to your email program, or by forwarding the email to us).
You may use both services simultaneously to create comprehensive MDR coverage within Workbench for your email monitoring.
## Investigation and Remediation Process
MDR for Email focuses on *the data included in the alerts* coming from your email security tools. Therefore we only ingest objects like sender, file name, file hash, subject, message size, reply-to address, URLs, recipient actions, etc. We do *not* review the full email text, examine the .eml files, or retrieve any files that may have been included in the original email (this level of ingestion is part of Managed Phishing).
### Ingestion and Triage
When an alert is generated by your email security tool, we ingest it and then process it according to our [detection strategy](#h_01jrjp0rrk2a4jqm6f2hme5vda). For suspected phishing attempts that may present a security issue, our Josie bot creates an [Expel Alert](/workbench-reference/alerts/how-expel-alerts-work.md) so that our SOC Analysts can determine whether or not they need to open an Investigation.
{% hint style="info" %}
You can look for information about your ingested email security alerts on any of the following Workbench pages: [Service Review dashboard](https://workbench.expel.io/dashboards/service-review), [Alert Analysis dashboard](https://workbench.expel.io/dashboards/alert-analysis), [Security Devices page](https://workbench.expel.io/settings/security-devices), or [Situation Report dashboard](https://workbench.expel.io/dashboards/situation-report).
{% endhint %}
### Investigation
The MDR for Email Investigation seeks answers to the following questions:
* Is the URL valid?
* Has anyone or any system at the organization accessed the URL?
* What can we discern about the sender domain, including its age and any historical virus information?
* Does the file hash contain any viruses?
* Do we have any existing information about the sender from prior incidents?
* Has anyone else at the organization received the same email?
* Is the file present on any other systems within the organization or any security devices?
* Have any suspicious logins occurred within the organization since the email was received?
* What can we discern about the source IP address?
* Are there any related Expel Alerts, either open or resolved?
If our SOC analysts do not believe the email associated with the alert is malicious after performing the Investigation, they will close it.
### Remediation
If our SOC analysts confirm during the Investigation that malicious activity is present, the Investigation is flagged as an incident. We then work with you (via [Remediation Actions](/workbench-reference/expel-terminology.md#remediation-action)) to remediate the phishing attempt and delete any malicious email(s), or you can automate part of this process by setting up the [Remove Malicious Email](/workbench-setup/auto-remediations/remove-malicious-email.md) auto remediation.
## Set Up MDR for Email
If you are ready to set up your service, we currently support the following email security tools:
* [Abnormal AI for MDR Setup](/connect-your-technology/a-c-integrations/abnormal-ai-setup-for-workbench.md)
* [Proofpoint TAP for MDR Setup](/connect-your-technology/l-p-integrations/proofpoint/proofpoint-tap-for-mdr-setup-for-workbench.md)
* [Sublime Security Setup for Workbench](/connect-your-technology/q-z-integrations/sublime-security-setup-for-workbench.md)
## Detection Strategy
Learn more in the MDR for Email Detection Strategy guides.
* [Abnormal AI Detection Strategy Guide](/detection-strategy-guides/a-c/abnormal-ai-detection-strategy.md)
* [Proofpoint TAP Detection Strategy Guide](/detection-strategy-guides/n-q/proofpoint/proofpoint-tap-detection-strategy.md)
* [Sublime Security Detection Strategy Guide](/detection-strategy-guides/s-z/sublime-security-detection-strategy.md)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.expel.io/connect-your-technology/about-integrations/about-mdr-for-email.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.