Getting Started with Managed Phishing Response

This guide provides step-by-step instructions for integrating our Managed Phishing Response solution with your reporting button. The process includes:

1. Assigning roles to give your team access to features

2. Connecting your reporting button to a Red Canary

3. Configuring automations for your reported phishes

4. Viewing reported phishes in the Red Canary portal

Prerequisites

Before you begin, make sure you have the following:

• You’re an Admin-level user (needed for Steps 1-2)

• You have a Microsoft Exchange or Google Workspace email environment

• You’re using a supported inbox reporting button:

  • KnowBe4 Phish Alert (PAB)

  • Proofpoint PhishAlarm

  • Outlook Report (Built-In)

1 Red Canary | Assign Roles to Your Security Team

Assign appropriate user permissions to members of your security team to access Managed Phishing Response. Permissions are role-specific and determine access to capabilities based on your team member’s responsibilities. See the table below for details.

To assign user roles:

1. Click the user icon at the top right of your Red Canary portal, then click Users & Roles.
   

2. Search for a user. If you need to add a new user, enter their email address in the top bar and click Invite.

3. Assign roles to the user by toggling a role name. Untoggle the role to remove it from the user.

2 Red Canary | Create a Collector

A Collector is a dedicated email address that receives user-reported emails from your reporting button. Once connected, all future reported emails will automatically be forwarded to Red Canary for assessment.

Note

Most organizations only need one Collector, but you should create additional Collectors if you use more than one reporting button or have multiple email environments.

1. In the Red Canary portal, go to Phishing > Settings and click New Collector.

2. On the New Collector page, select one Email Environment and one Reporting Product, then use the Description field to add any context relevant to your user-reported phishing workflows.

   

3. Click Save.

4. On the Settings page, locate the new Collector in the list:

   1. Copy the Collector Address.

   2. Click Setup Instructions and follow the button-specific steps shown in the slide-out panel.
      

3 Red Canary | Configure Automated Notifications and User Feedback

Set up automated notifications to give end-user feedback and keep your team informed about phishing activity. Red Canary uses triggers and playbooks to configure alert notifications and give users feedback on their reported emails.

Recommendations

We recommend configuring two types of notifications:

• Notification #1: Phish: Email your security team and end users when a phishing email is a confirmed Phish.

• Notification #2: Not a Phish: Email your security team when an email is confirmed Not a Phish.

While additional internal notifications such as Slack or Teams can be configured, we recommend email alerts as the minimum default setup.

Notification #1: Phish

Set up notifications to alert both your team and the user who reported the email whenever an email is confirmed as a phishing attempt (Assessment status=Phish).

1. In your Red Canary portal, navigate to Automation.

2. Click Configure new trigger, then select When a Reported Phish assessment changes.

3. Click Add condition and set it to Reported Phish Assessment is Phish.

   

4. Next to the newly created trigger, click Connect playbook, then Create a new playbook.

5. Name the playbook “Phishing Assessment (Phish).”
   

6. Click Add Action, then scroll down and select Send Email.
   

7. Add your email details for alerts to your security team. For example:

   • To: security@domainName.com

   • Subject: domainName Validated Email Phish Service

8. Click the Template dropdown and select Reported Phish Summary.

   Example: Confirmed Phish Summary Template

   Here’s an example of how the template looks as an email notification:
   

9. Click Save.
   

10. Click Add Action, then scroll down and select Send Email.

11. Add your email details for sending feedback to users using supported interpolation variables. For example:

    • To: $ReportedPhish.reporter_email

    • Reply to: No Reply To email set

    • Subject: You caught a phish! $ReportedPhish.email_subject

12. Click the Template dropdown and select Custom Freeform Email with Markdown rendered into HTML.

13. Add a custom message using supported interpolation variables. For example:

    You caught a phish! Initial analysis of your suspicious email submission has revealed a 
    phishing threat. A service ticket for this investigation has been opened on your behalf 
    and demo's Information Security team will conduct further investigation. At this time, 
    no further action is required on your part. You may receive follow-up communications and
    a final notification from the security team once the investigation is complete. 
    If you have questions or concerns regarding this matter, you can contact the 
    Information Security team at [security@demo.com](mailto:security@demo.com).
    
    **Assessment:** $ReportedPhish.assessment  
    **Assessment Summary:** $ReportedPhish.assessment_summary
    
    Thank you for your diligence in keeping demo safe from cyber threats!

14. Enable Send via custom SMTP relay / server (advanced) to ensure the email comes from your own server and not Red Canary.

15. Add your SMTP details. For example:

    • SMTP From Email Address: security@domainName.com

    • SMTP Host: smtp.office365.com

    • SMTP Port: 587

    • SMTP Username: demo@domainName.com

    • SMTP Password: *****

    • Enable STARTTLS: True

    • SMTP Authentication Method: Plain

16. (Optional) Enable Require Approval if you want someone on your team to approve sending the email notification to the user.

17. Click Save.
    

Notification #2: Not a Phish

Set up notifications to alert both your team and the user who reported the email whenever a reported phishing attempt is verified as a false alarm (Assessment status=Not a Phish).

1. In your Red Canary portal, navigate to Automation.

2. Click Configure new trigger, then select When a Reported Phish assessment changes.

3. Click Add condition and set it to Reported Phish Assessment is Not a Phish.

4. Next to the newly created trigger, click Connect playbook, then Create a new playbook.

5. Name the playbook “Phishing Assessment (Not a Phish).”

6. Click Add Action, then scroll down and select Send Email.

7. Add your email details for sending feedback to users, using supported interpolation variables. For example:

   • To: $ReportedPhish.reporter_email

   • Reply To: No Reply To email set

   • Subject: Phishing Email Submission Analysis Complete: $ReportedPhish.email_subject

8. Click the Template dropdown and select Custom Freeform Email with Markdown rendered into HTML.

9. Add a custom message using supported interpolation variables.

   Example: Custom Freeform Email Message

   Thank you for your diligence in keeping DEMO safe from cyber threats! 
   The Information Security team has analyzed your potential phishing email submission
   and determined that it does not appear to contain malicious links or attachments.
   Nevertheless, the email may still pose a threat if you do not know the sender, feel
   the email content is suspicious or targeted, or doubt its authenticity.
   If you have additional concerns, or if you believe that you have received this message
   in error, please contact the Information Security team at security@demo.com.
   
   Assessment: $ReportedPhish.assessment
   
   Assessment Summary: $ReportedPhish.assessment_summary
   
   ---
   
   #### Email Restoration
   Please note, after reporting a suspicious email by clicking the Phish Alert button in
   Gmail, reported emails are moved to the Trash folder. To restore them, follow the 
   steps below: 
   
   1. Open Gmail
   2. Click "Trash" in the left sidebar
   3. Find the reported email
   4. Select the email > click "Move to" > choose "Inbox" or desired folder
   5. The email will be restored to the selected folder. Note that emails in 
   Trash are permanently deleted after 30 days.
   
   Thank you!

10. Click Save.
    

4 Red Canary | View Reported Phishes

View all reports directly in your Red Canary portal. These reports provide full visibility into the email's contents and metadata, both before and after Red Canary completes its Assessment, allowing you to monitor emails that are still pending an Assessment decision.