# AQUILA - SNIFF & Detect

<span style="color: rgb(0, 0, 0);">**Outlook Add-in for Microsoft 365**</span>

---

#### <span style="color: rgb(53, 152, 219);">**Overview** </span>[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2026-03/scaled-1680-/BFSw7RHFx4DdtKYR-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2026-03/BFSw7RHFx4DdtKYR-image.png)

<span style="color: rgb(0, 0, 0);">AQUILA – SNIFF &amp; Detect is a custom integration app within the **AQUILA platform** that enables Microsoft 365 environments to deploy **advanced malicious email detection** capabilities.</span>  
<span style="color: rgb(0, 0, 0);">The app is packaged as a **manifest.xml** file and can be added to an organization’s Microsoft 365 tenant via the **Integration Apps** section in the Microsoft 365 Admin Center.</span>

---

#### <span style="color: rgb(53, 152, 219);">**Key Capabilities &amp; Value** </span>[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2026-03/scaled-1680-/8GsYtIeM7CiwrbzV-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2026-03/8GsYtIeM7CiwrbzV-image.png)

- <span style="color: rgb(0, 0, 0);">**Seamless Integration** – Install in Microsoft 365 with just a few clicks, no complex infrastructure required.</span>
- <span style="color: rgb(0, 0, 0);">**Permission-Driven Security** – Requires admin approval to grant permissions, ensuring a secure deployment process.</span>
- <span style="color: rgb(0, 0, 0);">**Centralized Control** – Managed via AQUILA and distributed through the AQUILA Store for consistent updates.</span>
- <span style="color: rgb(0, 0, 0);">**AI-Enhanced Detection** – Uses AQUILA’s AI and Cyber Threat Intelligence to scan and detect malicious emails in real time.</span>
- <span style="color: rgb(0, 0, 0);">**User-Friendly Accessibility** – Appears in the “More apps” section for assigned users, making it easy to launch.</span>
- <span style="color: rgb(0, 0, 0);">**Minimal Footprint** – Only ~6 KiB in size, ensuring fast installation without performance impact.</span>

---

#### <span style="color: rgb(53, 152, 219);">**<span class="TextRun SCXW129338488 BCX0" data-contrast="auto" lang="EN-PH" xml:lang="EN-PH"><span class="NormalTextRun SCXW129338488 BCX0">Installation &amp; Deployment Manual – Simple Step-by-Step</span></span>**</span>[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2026-03/scaled-1680-/K7Mmeai5fcmudTHG-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2026-03/K7Mmeai5fcmudTHG-image.png)

1. <span style="color: rgb(0, 0, 0);">**Download the Integration Package**</span>
    
    
    - <span style="color: rgb(0, 0, 0);">Visit the AQUILA Store and download the Sniff &amp; Detect integration (manifest.xml).</span>[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/scaled-1680-/b7bKUm3nKsq0c5Bm-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/b7bKUm3nKsq0c5Bm-image.png)
2. <span style="color: rgb(0, 0, 0);">**Access Microsoft 365 Admin Center - <span class="TextRun SCXW129338488 BCX0" data-contrast="auto" lang="EN-PH" xml:lang="EN-PH"><span class="NormalTextRun SCXW129338488 BCX0"> <span style="color: rgb(132, 63, 161);">[https://admin.microsoft.com](https://admin.microsoft.com/)</span></span></span>**</span>
    
    
    - <span style="color: rgb(0, 0, 0);">Log in as a **Global Admin** or **Exchange Admin**.</span>
3. <span style="color: rgb(0, 0, 0);">**Upload the Integration**</span>
    
    
    - <span style="color: rgb(0, 0, 0);">Go to **Settings** → **Integration Apps** → **Upload Custom Apps** </span>[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/scaled-1680-/GwkifKIdnmjk0lTD-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/GwkifKIdnmjk0lTD-image.png)
    - <span style="color: rgb(0, 0, 0);"><span class="TextRun SCXW129338488 BCX0" data-contrast="auto" lang="EN-PH" xml:lang="EN-PH"><span class="NormalTextRun SCXW129338488 BCX0">Follow the steps to Deploy the </span></span><span class="TextRun SCXW129338488 BCX0" data-contrast="auto" lang="EN-PH" xml:lang="EN-PH"><span class="NormalTextRun SCXW129338488 BCX0">Sniff and Detect </span></span><span class="TextRun SCXW129338488 BCX0" data-contrast="auto" lang="EN-PH" xml:lang="EN-PH"><span class="NormalTextRun SCXW129338488 BCX0">App</span></span><span class="EOP SCXW129338488 BCX0" data-ccp-props="{}"> .</span></span>
    - <span style="color: rgb(0, 0, 0);"><span class="EOP SCXW129338488 BCX0" data-ccp-props="{}">App Type → Office Add-in</span></span>
    - <div class="appsSectionStartContainer-924" elementtiming="5889" id="bkmrk-choose-how-to-upload">Choose how to upload app <span style="color: rgb(0, 0, 0);"><span class="EOP SCXW129338488 BCX0" data-ccp-props="{}">→ </span></span> Upload Manifest file (.xml) from device<span style="color: rgb(0, 0, 0);"><span class="EOP SCXW129338488 BCX0" data-ccp-props="{}">→ Choose</span></span><span style="color: rgb(0, 0, 0);"><span class="EOP SCXW129338488 BCX0" data-ccp-props="{}"> the manifest.xml file.</span></span></div><div class="ms-ChoiceFieldGroup root-1001" data-automation-id="ManifestSelection" elementtiming="5925"><div aria-labelledby="appUploadWaysLabel" elementtiming="5924" role="radiogroup"><div class="ms-ChoiceFieldGroup-flexContainer" elementtiming="5923">  
        </div></div></div>[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/scaled-1680-/r5PYE4pQkIBgAGDe-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/r5PYE4pQkIBgAGDe-image.png)
4. <span style="color: rgb(0, 0, 0);">**Deploy and Assign Users**</span>
    
    
    - <span style="color: rgb(0, 0, 0);">Assign the app to the relevant users or groups.</span><span style="color: rgb(0, 0, 0);"><span class="SCXW129338488 BCX0"><span class="WACImageContainer NoPadding BlobObject SCXW129338488 BCX0" role="presentation">![A screenshot of a computer
        
        AI-generated content may be incorrect.](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/n0UA10j7KNEKEACd-embedded-image-qfdhfvme.png)</span></span></span>
5. <span style="color: rgb(0, 0, 0);">**Grant Permissions**</span>
    
    
    - <span style="color: rgb(0, 0, 0);">Accept all required permissions:</span>
        
        
        - <span style="color: rgb(0, 0, 0);">ReadWriteItem</span>
        - <span style="color: rgb(0, 0, 0);">SendReceiveData</span><span style="color: rgb(0, 0, 0);"><span class="SCXW129338488 BCX0"><span class="WACImageContainer NoPadding BlobObject SCXW129338488 BCX0" role="presentation">![A screenshot of a computer
            
            AI-generated content may be incorrect.](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/dJR48DUn5j21lKkQ-embedded-image-cge2vkh0.png)</span></span></span>
6. <span style="color: rgb(0, 0, 0);">**Allow Propagation Time**</span>
    
    
    - <span class="MuiTypography-root MuiTypography-body1 css-pps2qs">In the Integrated Apps page of the Admin Center, confirm the add-in appears with status '<span style="color: rgb(22, 145, 121);">**OK**</span>'.</span>
    - <span style="color: rgb(0, 0, 0);">Wait up to **72 hours** for the app to be available across all assigned accounts.</span>[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/scaled-1680-/xFBy6BimbAdQektG-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/xFBy6BimbAdQektG-image.png)
7. <span style="color: rgb(0, 0, 0);">**Access the App**</span>
    
    
    - <span class="MuiTypography-root MuiTypography-body1 css-pps2qs">Open Outlook and check the apps panel to ensure Sniff &amp; Detect is listed and accessible.</span>
    - <span style="color: rgb(0, 0, 0);">Users can launch it from **More apps** in Microsoft 365.</span>

[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/scaled-1680-/x0FuZ3iJt7A0EjRE-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/x0FuZ3iJt7A0EjRE-image.png)

---

#### <span style="color: rgb(53, 152, 219);">**<span data-teams="true">How to Use Sniff and Detect </span>**</span>[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2026-03/scaled-1680-/s5bSBYRa4bCuZWbE-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2026-03/s5bSBYRa4bCuZWbE-image.png)

- <span style="color: rgb(0, 0, 0);">A phishing email impersonating Netflix. An arrow points to the **SNIFF &amp; Detect** icon, indicating where to scan or flag the email as suspicious.</span>

[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/scaled-1680-/fdE09hu7Rl60QyT9-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/fdE09hu7Rl60QyT9-image.png)

- <article class="text-token-text-primary w-full focus:outline-none scroll-mt-[calc(var(--header-height)+min(200px,max(70px,20svh)))]" data-scroll-anchor="true" data-testid="conversation-turn-24" data-turn="assistant" data-turn-id="request-WEB:f057c933-6170-480a-a00a-6172cc6a9351-11" dir="auto" tabindex="-1"><span style="color: rgb(0, 0, 0);">Click the “**Scan This Email**” button and wait for the scan to complete.</span>
    
    </article>

[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/scaled-1680-/pRLtXFAqIgrMvZMx-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/pRLtXFAqIgrMvZMx-image.png)

- <span style="color: rgb(0, 0, 0);">SNIFF &amp; Detect has scanned the email, highlighting possible errors such as  
    1. Arrow **1** points to the **Language issues** section, showing spelling and grammar mistakes found in the phishing email.  
    2. Arrow **2** points to the **What you should do** section, giving safety advice on how to handle the suspicious email.</span>

[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/scaled-1680-/o6vEVWiMGeCI3Gsk-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/o6vEVWiMGeCI3Gsk-image.png)

- <span style="color: rgb(0, 0, 0);">**Arrow 1** – Highlights the **AI Insight Results** tab in SNIFF &amp; Detect, which contains the automated analysis results of the scanned email.</span>
- <span style="color: rgb(0, 0, 0);">**Arrow 2** – Points to the **Malicious** classification summary. This section briefly explains the reasons the email is flagged, such as suspicious sender details, urgent tone, spelling and grammar errors, and suspicious links.</span>
- <span style="color: rgb(0, 0, 0);">**Arrow 3** – Directs attention to the actual phishing email content pretending to be from Netflix, warning about a payment failure and urging the user to update their payment information.</span>
- <span style="color: rgb(0, 0, 0);">**Arrow 4** – Indicates the **Report as Phishing** button, which the user can click to formally report the suspicious email to security for further action.</span>

[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/scaled-1680-/xCI6XwmmK0SHb2Jv-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/xCI6XwmmK0SHb2Jv-image.png)

- <span style="color: rgb(0, 0, 0);">Click the "**Run a deep scan**" button, which allows for a more detailed examination of the email to detect hidden threats and malicious indicators.</span>

[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/scaled-1680-/51ELQvK9m7iXcuUC-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/51ELQvK9m7iXcuUC-image.png)

- <span style="color: rgb(0, 0, 0);">**SNIFF &amp; Detect** doing a deep scan on a suspected phishing email pretending to be from Netflix. The scan may take a couple of minutes to finish.</span>

[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/scaled-1680-/W3myFSHB02eaTvS2-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/W3myFSHB02eaTvS2-image.png)

- <span style="color: rgb(0, 0, 0);">The scan results are now finished and ready to check.</span>

[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/scaled-1680-/mALzljyROiLcmqPz-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/mALzljyROiLcmqPz-image.png)

- <span style="color: rgb(0, 0, 0);">This is the result of a deep scan conducted by the Sniff &amp; Detect tool on a suspicious email impersonating Netflix.</span>  
    <span style="color: rgb(0, 0, 0);">1. **Arrow 1** highlights the domain **netflix-billing.com,** which is flagged as a spoofed domain used to impersonate Netflix and trick users into entering sensitive information.</span>  
    <span style="color: rgb(0, 0, 0);">2. **Arrow 2** lists phishing-related email addresses such as **richmond@cytcehint.com** and [<span style="color: rgb(0, 0, 0);">**support@netflix-billing.com**</span>](mailto:support@netflix-billing), which are likely used to send or support the fraudulent email.</span>  
    <span style="color: rgb(0, 0, 0);">3. **Arrow 3** shows the IP address **192.168.1.45**, flagged as part of the phishing infrastructure. Although it's a private IP, its presence suggests internal spoofing or malicious setup.</span>

[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/scaled-1680-/4JxCoYEvR1qYSOzV-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-08/4JxCoYEvR1qYSOzV-image.png)

<span class="EOP SCXW129338488 BCX0" data-ccp-props="{}" style="color: rgb(0, 0, 0);">*If you need further assistance, kindly contact our support at* <span style="color: rgb(53, 152, 219);">***support@cytechint.com***</span> *for prompt assistance and guidance.*</span>