Machine-Generated Email Detection

The Netskope SMTP Proxy can classify each outbound email it inspects as machine-generated or human-originated. Machine-generated email includes system notifications, application alerts, transactional messages, automated reports, and auto-replies. The classification is recorded on the email’s Skope IT event and on any DLP alert or incident it produces, so you can distinguish automated traffic from user-sent email when reviewing events and incidents. The existing SMTP Proxy license is designed for user-initiated outbound email. Machine-generated email can be classified during inspection so that it is identifiable in events and incidents. Contact your Netskope account team before routing high-volume automated email through the SMTP Proxy to review options.

Detection runs during inline inspection and adds no user-visible change to the email. It does not alter how the email is scanned, matched against policy, or delivered.

How Detection Works

After the SMTP Proxy receives the complete message, it evaluates the message headers, envelope, and body against a set of automation indicators. Each matching indicator contributes to a score. When the score reaches the detection threshold, the email is classified as machine-generated with a confidence of High, Medium, or Low. High confidence indicates several strong indicators were present. Low confidence indicates fewer or weaker indicators. Detection uses only the content of the message being processed. It does not depend on sender volume, sending frequency, or historical behavior.

View Detection Results

The following fields are added to Skope IT application events, policy alerts, DLP alerts, and DLP incidents for email processed by the SMTP Proxy:

To view the fields:

1. Go to Skope IT > Alerts or Skope IT > Application Events and open an event for an email processed by the SMTP Proxy.

2. Go to Incidents > DLP. You can filter, sort, and export on Machine Email Detected and Machine Email Confidence.