Getting Started with Managed Phishing Response

This guide provides step-by-step instructions for integrating our Managed Phishing Response solution with your reporting button. The process includes:

1. Assigning roles to give your team access to features

2. Connecting your reporting button to a Red Canary

3. Configuring automations for your reported phishes

4. Viewing reported phishes in the Red Canary portal

Prerequisites

Before you begin, make sure you have the following:

• You’re an Admin-level user (needed for Steps 1-2)

• You have a Microsoft Exchange or Google Workspace email environment

• You’re using a supported inbox reporting button:

  • KnowBe4 Phish Alert (PAB)

  • Proofpoint PhishAlarm

  • Outlook Report (Built-In)

1 Red Canary | Assign Roles to Your Security Team

Assign appropriate user permissions to members of your security team to access Managed Phishing Response. Permissions are role-specific and determine access to capabilities based on your team member’s responsibilities.

To assign user roles:

1. Click the user icon at the top right of your Red Canary portal, then click Users & Roles.
   

2. Search for a user. If you need to add a new user, enter their email address in the top bar and click Invite.

3. Assign roles to the user by toggling a role name. Untoggle the role to remove it from the user.

2 Red Canary | Create a Collector

A Collector is a dedicated email address that receives user-reported emails from your reporting button. Once connected, all future reported emails will automatically be forwarded to Red Canary for assessment.

Note

Most organizations only need one Collector, but you should create additional Collectors if you use more than one reporting button or have multiple email environments.

1. In the Red Canary portal, go to Phishing > Settings and click New Collector.

2. On the New Collector page, select one Email Environment and one Reporting Product, then use the Description field to add any context relevant to your user-reported phishing workflows.

   

3. Click Save.

4. On the Settings page, locate the new Collector in the list:

   1. Copy the Collector Address.

   2. Click Setup Instructions and follow the button-specific steps shown in the slide-out panel.
      

3 Red Canary | Configure Automations for Reported Phishes

Set up automated triggers and playbooks to quickly close the loop with reporting users and inform your team of reported phish activities. Triggers define when an automation should begin and can be limited by conditions. They connect to playbooks that group actions you want to take to achieve a goal. These actions can be customized with variables interpolated in at runtime.

Recommended Setup

As a starting point, Red Canary recommends three different automations to help you streamline response to reported phishes. Each uses the same base trigger, but applies different conditions and playbooks.

Automation 1: Notify Your Team of a Confirmed Phish

Ensure your team is informed whenever a reported phish is assessed and confirmed to be phishing.

1. In your Red Canary portal, navigate to Automation.

2. On the Automation page, click Configure new trigger.

3. Select When a Reported Phish assessment changes.

4. Click Add condition and set it to Reported Phish > Assessment > is > Phish.

5. Click Connect playbook and select Create a new playbook.

6. Click Add Action, then select Send Email and configure:

   1. To: Enter email addresses for your security team

   2. Subject: Customize the subject (e.g., “Red Canary Confirmed Phish Assessment”)

   3. Template: Select “Reported Phish Summary”

7. Once you’re done editing the automated email, click Save.

Automation 2: Notify Reporters When They Catch a Phish

Send timely feedback to close the loop with users when they report an email that’s confirmed as a Phish.

1. On the Automation page, click Configure new trigger.

2. Select When a Reported Phish assessment changes.

3. Click Add condition and set it to Reported Phish > Assessment > is > Phish.

4. Click Add condition and set it to Reported Phish > Previous Assessment > is not present.
   

5. Click Connect playbook, then select Create a new playbook.

6. Click Add Action, then select Send Email and configure:

   1. From: Set a custom sender address users will recognize

   2. To: $ReportedPhish.reporter_email

   3. Subject: Customize the subject (e.g., “You caught a Phish!”)

   4. Template: Select “Custom Freeform Email with Markdown rendered into HTML”

   5. Message: Customize the email using markdown and interpolation variables

7. Once you’re done editing the automated email, click Save.

Automation 3: Notify Reporters When Their Email is Not a Phish

Send timely feedback to close the loop with users when they report an email that is Not a Phish.

1. On the Automation page, click Configure new trigger.

2. Select When a Reported Phish assessment changes.

3. Click Add condition and set it to Reported Phish > Assessment > is > Not a Phish.

4. Click Add condition and set it to Reported Phish > Previous Assessment > is not present.
   

5. Click Connect playbook, then select Create a new playbook.

6. Click Add Action, then select Send Email and configure:

   1. From: Set a custom sender address users will recognize

   2. To: $ReportedPhish.reporter_email

   3. Subject: Customize the subject (e.g., “Feedback on the email your reported”)

   4. Template: Select “Custom Freeform Email with Markdown rendered into HTML”

   5. Message: Customize the email using markdown and interpolation variables

7. Once you’re done editing the automated email, click Save.

4 Red Canary | View Reported Phishes

View all reports directly in your Red Canary portal. These reports provide full visibility into the email's contents and metadata, both before and after Red Canary completes its Assessment, allowing you to monitor emails that are still pending an Assessment decision.