---
title: "Getting Started with Managed Phishing Response"
slug: "getting-started-with-managed-phishing-response"
updated: 2026-09-09T16:09:40Z
published: 2026-09-09T16:09:40Z
canonical: "docs.redcanary.com/getting-started-with-managed-phishing-response"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Getting Started with Managed Phishing Response

This guide provides step-by-step instructions for integrating our Managed Phishing Response solution with your reporting button. The process includes:

1. Assigning roles to give your team access to features
2. Connecting your reporting button to a Zscaler MDR
3. Configuring automations for your reported phishes
4. Viewing reported phishes in the Zscaler MDR portal

## Prerequisites

Before you begin, make sure you have the following:

- You’re an Admin-level user
- You have a Microsoft Exchange or Google Workspace email environment
- You’re using a supported inbox reporting button:
  - KnowBe4 Phish Alert (PAB)
  - Proofpoint PhishAlarm
  - Outlook Report (Built-In)
  - InfoSec IQ PhishNotify
  - Custom Gmail Add-On (customer-provided)

## 1 Zscaler MDR | Assign Roles to Your Security Team

Assign appropriate user permissions to members of your security team to access Managed Phishing Response. Permissions are role-specific and determine access to capabilities based on your team member’s responsibilities.

****User Roles and Permissions****

| Role | Description | Permissions |
| --- | --- | --- |
| Analyst Viewer | Allows users view-only access of reported phishes | - View reported phishes and their assessment - View automation triggers and playbooks |
| Analyst | Builds upon Analyst Viewer, allowing users to change assessments and add comments to reported phishes | - View reported phishes and their assessment - View automation triggers and playbooks - Modify assessments for reported phishes - Add comments to a reported phish’s activity timeline |
| Admin | Grants users advanced permissions to configure Reported Phish Collectors | - Create and manage automated triggers and playbooks for reported phishes - Access the **Phishing > Settings** page to create and manage Collectors for reported phishes > [!NOTE] > Note > > Admin users must also be assigned the **Analyst** or **Analyst Viewer** role to access the Phishing and **Phishing > Settings** pages in your portal. |
| Responder | Allows users to configure automations for reported phishes | - Create and manage automated triggers and playbooks for reported phishes |
| Technical Contact | Allows users to configure automations for reported phishes | - Create and manage automated triggers and playbooks for reported phishes |

To assign user roles:

1. Click the user icon at the top right of your Zscaler MDR portal, then click **Users & Roles.** ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminroles-1-01.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A04Z&se=2026-11-09T13%3A08%3A04Z&sr=c&sp=r&sig=X%2FCMszLOUNuDXHq%2FYWOMNYCBDE3VO3CMSEY7n%2Fs9Uos%3D)
2. Search for a user. If you need to add a new user, enter their email address in the top bar and click **Invite**.
3. Assign roles to the user by toggling a role name. Untoggle the role to remove it from the user.![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminroles-1-02.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A04Z&se=2026-11-09T13%3A08%3A04Z&sr=c&sp=r&sig=X%2FCMszLOUNuDXHq%2FYWOMNYCBDE3VO3CMSEY7n%2Fs9Uos%3D)

## 2 Zscaler MDR | Create a Collector

A Collector is a dedicated email address that receives user-reported emails from your reporting button. Once connected, all future reported emails will automatically be forwarded to Zscaler MDR for assessment.

> [!NOTE]
> Note
> 
> Most organizations only need one Collector, but you should create additional Collectors if you use more than one reporting button or have multiple email environments.

1. In the Zscaler MDR portal, go to **Phishing > Settings** and click **New Collector**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/getstartedphishing-2_10.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A04Z&se=2026-11-09T13%3A08%3A04Z&sr=c&sp=r&sig=X%2FCMszLOUNuDXHq%2FYWOMNYCBDE3VO3CMSEY7n%2Fs9Uos%3D)
2. On the New Collector page, select one **Email Environment** and one **Reporting Product**, then use the **Description** field to add any context relevant to your user-reported phishing workflows.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/getstartedphishing-2_02.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A04Z&se=2026-11-09T13%3A08%3A04Z&sr=c&sp=r&sig=X%2FCMszLOUNuDXHq%2FYWOMNYCBDE3VO3CMSEY7n%2Fs9Uos%3D)
3. Click **Save**.
4. On the Settings page, locate the new Collector in the list:
  1. Copy the **Collector Address**.
  2. Click **Setup Instructions** and follow the button-specific steps shown in the slide-out panel. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/getstartedphishing-2_09.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A04Z&se=2026-11-09T13%3A08%3A04Z&sr=c&sp=r&sig=X%2FCMszLOUNuDXHq%2FYWOMNYCBDE3VO3CMSEY7n%2Fs9Uos%3D)

## 3 Zscaler MDR | [OPTIONAL] Enable Recipient Enrichment

> [!NOTE]
> Note
> 
> Recipient enrichment is optional. Recipient metrics (submission counts, accuracy, and links to related reported phishes) are available to all customers by default without any enrichment setup required.

Recipient Enrichment allows Zscaler MDR to pull identity data from your connected identity providers and surface it on reported phishes during assessment. When enabled, analysts reviewing a reported phish can see the reporter’s display name, job title, and department alongside their submission history, providing additional context for evaluating the sender’s likely target.

Supported sources include:

- Microsoft Azure
- Microsoft Entra ID
- Microsoft Office 365
- Okta Workforce Identity

To enable an enrichment source:

1. On the **Phishing > Settings** page, locate the Recipient Enrichment card. If no supported identity sources are active in your environment, the card will be empty. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/getstartedphishing-2_11.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A04Z&se=2026-11-09T13%3A08%3A04Z&sr=c&sp=r&sig=X%2FCMszLOUNuDXHq%2FYWOMNYCBDE3VO3CMSEY7n%2Fs9Uos%3D)

> [!NOTE]
> Seeing multiple integrations?
> 
> If you have identity integrations configured that support on-demand querying of user attributes, each one will appear in your Recipient Enrichment settings. You only need to enable the integration that serves as your organization's authoritative source for current user attributes (display names, job titles, departments, etc.).
> 
> Most organizations only need to enable one source — this avoids unnecessary API calls and keeps data consistent. Enable multiple sources only if you maintain separate identity systems for distinct user populations (e.g., Okta for employees, Azure AD for contractors).
2. Click on the identity source (Supported Integration) you want to enable for enrichment, which brings you to the integration configuration page.
  - For Okta and 0365 sources, click **Configure**, then check the consent checkbox.
  - For Azure and Entra ID sources, click **Step 5: Managed Phishing Response: Configure Recipient Enrichment**, and then check the consent checkbox.

Once consent is granted, the enrichment process runs automatically during processing of each new reported phish.

## 4 Zscaler MDR | [OPTIONAL] Set up Link Demystifying

> [!NOTE]
> Note
> 
> Link Demystifying is optional. By default, Microsoft Safe Links and Proofpoint URL Defense links are demystified automatically when detected, even if they are not configured in your Link Demystifying settings. We still recommend adding them so Zscaler MDR has additional context about your email environment for assessment and troubleshooting.

Link Demystifying allows Zscaler MDR to decode rewritten links found in reported phishes and reveal the original destination URL for assessment. This helps analysts better understand where a link actually leads when email protection services have rewritten it.

Link Demystifying allows Zscaler MDR to decode rewritten links found in reported phishes and reveal the original destination URL during assessment.

Supported services include:

- Microsoft Safe Links
- Proofpoint URL Defense
- Mimecast URL Protect

To configure a link protection service:

1. On the **Phishing > Settings** page, locate the Link Demystifying card.
2. Click **New Demystifier.**
3. In **Link protection service**, select the service you want to configure.
4. In **Assigned Collectors**, select the collectors that use that link protection service.
  1. If you selected **Microsoft Safe Links** or **Proofpoint URL Defense**, no credentials or additional setup is required.
  2. If you selected **Mimecast URL Protect**, complete the Mimecast setup below, then enter your Mimecast **Client ID** and **Client Secret** before saving your configuration.
5. Click **Save**.

****Mimecast URL Protect setup requirements****

To demystify Mimecast URL Protect links in Zscaler MDR, first complete the following setup in Mimecast:

1. Create a dedicated **Administrator role** in Mimecast that grants only the permission needed for URL decoding: **Account** | **Dashboard** | **Read**.
2. Register a new **API 2.0 application** for Zscaler MDR and assign it the custom Administrator role.
3. Generate the application’s **Client ID** and **Client Secret**.
4. Use the application’s Client ID and Client Secret when configuring **Link Demystifying** in Zscaler MDR.

## 5 Zscaler MDR | Configure Automations for Reported Phishes

Set up automated triggers and playbooks to quickly close the loop with reporting users and inform your team of reported phish activities. Triggers define when an automation should begin and can be limited by conditions. They connect to playbooks that group actions you want to take to achieve a goal. These actions can be customized with variables interpolated in at runtime.

****Reported Phish Triggers and Conditions****

The following triggers are available for reported phishes:

- When a Reported Phish is collected
- When a Reported Phish assessment changes
- When a Reported Phish hasn’t been assessed for 2 hours

The following conditions are available for all reported phish conditions:

- Hour of Day
- Reported Phish Assessment
- Reported Phish Assessment Summary
- Reported Phish Collector Description
- Reported Phish Collector Email Environment
- Reported Phish Collector ID
- Reported Phish Collector Reporting Product
- Reported Phish Email From
- Reported Phish Email Reply To
- Reported Phish Email Subject
- Reported Phish Email To
- Reported Phish Previous Assessment
- Reported Phish Reporter Accuracy Rate
- Reported Phish Reporter Departments
- Reported Phish Reporter Display Names
- Reported Phish Reporter Display Names
- Reported Phish Reporter Display Names
- Reported Phish Reporter Enrichment Native JSON
- Reported Phish Reporter Job Titles
- Reported Phish Reporter Total Reports
- Reported Phish Reporting User Email
- Reported Phish Return Path
- Time Day of Week

****Supported Playbook Actions and Variables****

The following playbook actions are available for reported phishes:

- Send Slack Message
- Send Microsoft Teams Message
- Invoke Webhook or API
- Send Syslog Message
- Send Email
- Call Phone Numbers
- Send SMS Message

The following interpolation variables are available for reported phishes:

| Attribute | Example | Description |
| --- | --- | --- |
| Assessment | `$ReportedPhish.assessment` | The Assessment of the reported phish, either `tbd`, `phish`, or `not a phish` |
| Assessment Summary | `$ReportedPhish.assessment_summary` | The reasoning behind or additional notes around the Assessment |
| Collected At | `$ReportedPhish.collected_at` | The time when the reported phish was collected by Zscaler MDR |
| Collector Description | `$Collector.description` | Details about the reporting environment associated with the Collector that collected the reported phish |
| Collector Email Environment | `$Collector.email_environment` | The email environment where the reported phish collected by the Collector originated |
| Collector ID | `$Collector.id` | The unique Zscaler MDR identifier for the Collector that collected the reported phish |
| Collector Reporting Product | `$Collector.reporting_product` | The reporting product used to report the reported phish collected by the Collector |
| Email From | `$ReportedPhish.email_from` | The sender of the reported email |
| Email Message ID | `$ReportedPhish.email_message_id` | The Message ID of the email (from the `Message-ID` header) |
| Email Origination Date | `$ReportedPhish.email_origination_date` | The Origination Date of the email (from the `date` header, in UTC) |
| Email Reply To | `$ReportedPhish.email_reply_to` | The reply to address of the reported email |
| Email Subject | `$ReportedPhish.email_subject` | The subject of the reported email |
| Email To | `$ReportedPhish.email_to` | The recipients of the reported email |
| Previous Assessment | `$ReportedPhish.previous_assessment` | The previous Assessment of the reported phish before it was changed |
| Reported Phish ID | `$ReportedPhish.id` | The unique Zscaler MDR identifier of the reported phish |
| Reporter Accuracy Rate | `$ReportedPhish.reporter_accuracy_rate` | The percentage of this reporter's reports that were assessed as phish (excluding TBD assessments) |
| Reporter Total Reports | `$ReportedPhish.reporter_total_reports` | The total number of emails this reporter has reported across all time |
| Reporting User Departments | `$ReportedPhish.reporter_departments` | The departments of the users who reported the phish > [!NOTE] > Note > > Requires [Recipient Enrichment](/doc/docs/getting-started-with-managed-phishing-response#3-red-canary-enable-recipient-enrichment) to be enabled |
| Reporting User Departments with Enrichment Sources | `$ReportedPhish.reporter_departments_with_enrichment_sources` | The departments of the users who reported the phish, including the enrichment source for each value > [!NOTE] > Note > > Requires [Recipient Enrichment](/doc/docs/getting-started-with-managed-phishing-response#3-red-canary-enable-recipient-enrichment) to be enabled |
| Reporting User Display Names | `$ReportedPhish.reporter_display_names` | The display names of the users who reported the phish > [!NOTE] > Note > > Requires [Recipient Enrichment](/doc/docs/getting-started-with-managed-phishing-response#3-red-canary-enable-recipient-enrichment) to be enabled |
| Reporting User Display Names with Enrichment Sources | `$ReportedPhish.reporter_display_names_with_enrichment_sources` | The display names of the users who reported the phish, including the enrichment source for each value > [!NOTE] > Note > > Requires [Recipient Enrichment](/doc/docs/getting-started-with-managed-phishing-response#3-red-canary-enable-recipient-enrichment) to be enabled |
| Reporting User Email | `$ReportedPhish.reporter_email` | The email address of the user who reported the phish. |
| Reporting User Enrichment Raw JSON | `$ReportedPhish.reporter_enrichment_native_json_raw` | The raw, unprocessed JSON enrichment data for the users who reported the phish, in its native format from the enrichment source > [!NOTE] > Note > > Requires [Recipient Enrichment](/doc/docs/getting-started-with-managed-phishing-response#3-red-canary-enable-recipient-enrichment) to be enabled |
| Reporting User Job Titles | `$ReportedPhish.reporter_job_titles` | The job titles of the users who reported the phish > [!NOTE] > Note > > Requires [Recipient Enrichment](/doc/docs/getting-started-with-managed-phishing-response#3-red-canary-enable-recipient-enrichment) to be enabled |
| Reporting User Job Titles with Enrichment Sources | `$ReportedPhish.reporter_job_titles_with_enrichment_sources` | The job titles of the users who reported the phish, including the enrichment source for each value > [!NOTE] > Note > > Requires [Recipient Enrichment](/doc/docs/getting-started-with-managed-phishing-response#3-red-canary-enable-recipient-enrichment) to be enabled |

### Recommended Setup

As a starting point, Zscaler MDR recommends three different automations to help you streamline response to reported phishes. Each uses the same base trigger, but applies different conditions and playbooks.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/getstartedphishing-3_10(1).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A04Z&se=2026-11-09T13%3A08%3A04Z&sr=c&sp=r&sig=X%2FCMszLOUNuDXHq%2FYWOMNYCBDE3VO3CMSEY7n%2Fs9Uos%3D)

### Automation 1: Notify Your Team of a Confirmed Phish

Ensure your team is informed whenever a reported phish is assessed and confirmed to be phishing.

1. In your Zscaler MDR portal, navigate to **Automation**.
2. On the Automation page, click **Configure new trigger**.
3. Select **When a Reported Phish assessment changes**.
4. Click **Add condition** and set it to **Reported Phish > Assessment > is > Phish**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/getstartedphishing-3_18.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A04Z&se=2026-11-09T13%3A08%3A04Z&sr=c&sp=r&sig=X%2FCMszLOUNuDXHq%2FYWOMNYCBDE3VO3CMSEY7n%2Fs9Uos%3D)
5. Click **Connect playbook** and select **Create a new playbook**.
6. Click **Add Action**, then select **Send Email** and configure:
  1. **To**: Enter email addresses for your security team
  2. **Subject**: Customize the subject (e.g., “Zscaler MDR Confirmed Phish Assessment”)
  3. **Template**: Select “Reported Phish Summary”
7. Once you’re done editing the automated email, click **Save**.

**Example: Email Configuration for “Phish” Escalations**

The following image shows a sample **Send Email** configuration: ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/getstartedphishing-3_12.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A04Z&se=2026-11-09T13%3A08%3A04Z&sr=c&sp=r&sig=X%2FCMszLOUNuDXHq%2FYWOMNYCBDE3VO3CMSEY7n%2Fs9Uos%3D)

****Example: Reported Phish Summary Template****

The following image shows how the template renders as an email notification:

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/getstartedphishing-3_13.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A04Z&se=2026-11-09T13%3A08%3A04Z&sr=c&sp=r&sig=X%2FCMszLOUNuDXHq%2FYWOMNYCBDE3VO3CMSEY7n%2Fs9Uos%3D)

### Automation 2: Notify Reporters When They Catch a Phish

Send timely feedback to close the loop with users when they report an email that’s confirmed as a Phish.

1. On the Automation page, click **Configure new trigger**.
2. Select **When a Reported Phish assessment changes**.
3. Click **Add condition** and set it to **Reported Phish > Assessment > is > Phish**.
4. Click **Add condition** and set it to **Reported Phish > Previous Assessment > is not present**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/getstartedphishing-3_15.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A04Z&se=2026-11-09T13%3A08%3A04Z&sr=c&sp=r&sig=X%2FCMszLOUNuDXHq%2FYWOMNYCBDE3VO3CMSEY7n%2Fs9Uos%3D)
5. Click **Connect playbook**, then select **Create a new playbook**.
6. Click **Add Action**, then select **Send Email** and configure:
  1. **From**: Set a custom sender address users will recognize
  2. **To**: `$ReportedPhish.reporter_email`
  3. **Subject**: Customize the subject (e.g., “You caught a Phish!”)
  4. **Template**: Select “Custom Freeform Email with Markdown rendered into HTML”
  5. **Message**: Customize the email using markdown and interpolation variables
7. Once you’re done editing the automated email, click **Save**.

****Example: Email Configuration for “Phish” Feedback****

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/getstartedphishing-3_14.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A04Z&se=2026-11-09T13%3A08%3A04Z&sr=c&sp=r&sig=X%2FCMszLOUNuDXHq%2FYWOMNYCBDE3VO3CMSEY7n%2Fs9Uos%3D)

### Automation 3: Notify Reporters When Their Email is Not a Phish

Send timely feedback to close the loop with users when they report an email that is Not a Phish.

1. On the Automation page, click **Configure new trigger**.
2. Select **When a Reported Phish assessment changes**.
3. Click **Add condition** and set it to **Reported Phish > Assessment > is > Not a Phish**.
4. Click **Add condition** and set it to **Reported Phish > Previous Assessment > is not present**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/getstartedphishing-3_19.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A04Z&se=2026-11-09T13%3A08%3A04Z&sr=c&sp=r&sig=X%2FCMszLOUNuDXHq%2FYWOMNYCBDE3VO3CMSEY7n%2Fs9Uos%3D)
5. Click **Connect playbook**, then select **Create a new playbook**.
6. Click **Add Action**, then select **Send Email** and configure:
  1. **From**: Set a custom sender address users will recognize
  2. **To**: `$ReportedPhish.reporter_email`
  3. **Subject**: Customize the subject (e.g., “Feedback on the email your reported”)
  4. **Template**: Select “Custom Freeform Email with Markdown rendered into HTML”
  5. **Message**: Customize the email using markdown and interpolation variables
7. Once you’re done editing the automated email, click **Save**.

****Example: Email Configuration for “Not a Phish” Feedback****

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/getstartedphishing-3_17.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A04Z&se=2026-11-09T13%3A08%3A04Z&sr=c&sp=r&sig=X%2FCMszLOUNuDXHq%2FYWOMNYCBDE3VO3CMSEY7n%2Fs9Uos%3D)

## 6 Zscaler MDR | View Reported Phishes

View all reports directly in your Zscaler MDR portal. These reports provide full visibility into the email's contents and metadata, both before and after Zscaler MDR completes its Assessment, allowing you to monitor emails that are still pending an Assessment decision. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/getstartedphishing-4_01.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A04Z&se=2026-11-09T13%3A08%3A04Z&sr=c&sp=r&sig=X%2FCMszLOUNuDXHq%2FYWOMNYCBDE3VO3CMSEY7n%2Fs9Uos%3D)

To learn more about navigating a reported email, see [Navigating Phishing Reports in Zscaler MDR](/doc/docs/navigating-phishing-reports-in-red-canary).