Set up reports, triage them and connect webhooks

Your staff receive doubtful emails: real phishing, spam, or PhishTrainer simulations. Reporting lets them pass these emails on to your security team, which finds them in PhishTrainer.

A source describes the path a reported email takes to PhishTrainer. There are two families, shown in the Add a reporting source window:

• PhishTrainer reads a mailbox: your staff forward the suspicious email to a dedicated address (for example report@your-domain.com), which PhishTrainer reads at regular intervals;
• A “Report” button in the mail client: an add-in adds a button to the mail client; the email goes straight to PhishTrainer, with no intermediate mailbox.

You can configure several sources and combine them, for example a reporting mailbox and an Outlook add-in. Each one is enabled independently.

First create a mailbox dedicated to reports with your email provider. Then choose Mailbox (IMAP) and fill in the fields. Fields marked with an asterisk are required.

Give them the address of the reporting mailbox. Ask them to forward the suspicious email as an attachment when their mail client allows it: PhishTrainer then analyzes the original email as it is. A regular forward (in the message body) is also accepted, but the original sender is only found if it remains readable in the forwarded block.

PhishTrainer reads an Exchange Online mailbox through Microsoft Graph, with an application registered in your Microsoft Entra, without a mailbox password. The application can only read this one mailbox. Combined with the “Report” button built into Outlook, this source receives the emails your staff report with that button.

Choose Microsoft 365 mailbox. The window shows the procedure on the left (Prepare Microsoft 365) and the fields to fill in on the right. Two methods are offered: Manually (recommended), where you make each setting in the Microsoft portals, or With the script, a PowerShell script that makes the settings for you. The window details each step; here is how they fit together.

Exchange permissions take 30 minutes to 2 hours to apply: a test refused just after saving is normal, try again later. The test reads no message; it tells you whether the mailbox is empty or holds messages to collect.

The three add-ins (Outlook for Windows (VSTO), Outlook Microsoft 365, Gmail (Google Workspace)) are added the same way: choose the type, fill in Source name:, check that Reception enabled is ticked and save. The source then shows an activation code and the tabs Settings, Installation, Message to employees, plus Enrolled devices (VSTO) or Links and users (Microsoft 365, Gmail). The Delete the email after reporting option moves the reported email to the employee’s deleted items, from where it can still be recovered.

Each add-in has its own deployment guide:

Each source in the My receiving sources list carries an Enabled or Disabled badge. Sources that read a mailbox show Last collection: and the latest error, if any; add-ins show Last report received:. Available actions:

Open Suspicious emails in the PhishTrainer menu, or click View suspicious emails on the sources page. An email reported by several employees appears only once: classifying it classifies it for everyone.

The Overview card gives, for the chosen Statistics period (7 days to 12 months): the number of Reported emails, those To analyze, the share of PhishTrainer simulations, the breakdown by Analysis result and by reported type (Reported as), and the Domains to analyze and Domains classified as phishing or spam. Clicking a domain filters the list on its emails.

The tabs filter by result: All, To analyze, Phishing, Spam, Benign, Undetermined, PhishTrainer simulations. Further filters: Sender domain, Reported as (phishing or spam, as declared by the employee), Declared interactions and Period. Sort by offers Most recent, To analyze for the longest and Most reported. Emails to analyze are highlighted.

Click a row to open Email details: sender, subject, first and last report dates, type, result, Last classification (who and when), then Employees who received it, Message body, Indicators (URLs, domains, sender, IP addresses, attachment hashes) and Attachments (name, type, size, SHA-256). The body is shown in an isolated frame; attachments cannot be downloaded.

Each report has a status: To analyze, Analysing or Classified. An email with no classification shows To analyze.

When an employee reports a simulation email, PhishTrainer recognizes it and classifies it automatically (Last classification: Automatic). The view campaign results link opens the campaign concerned. Unmatched PhishTrainer simulation marks a recognized simulation for which no campaign was found.

With some add-ins, the employee states what they did with the email: clicked a link, opened an attachment, entered credentials, replied or called. The Interacted badge flags entered credentials or an opened attachment; Interaction declared flags a clicked link, a reply or a call. For mailbox collection, the question is not asked (Not asked). The With a risky interaction filter isolates these emails.

A webhook is a web address (URL) of your application to which PhishTrainer sends data as your campaigns run. Use it to feed a SIEM, a ticketing tool or a team chat channel, without checking the extranet by hand.

Each delivery is an HTTP POST request whose body is a JSON document. Your application must answer with an HTTP code below 400: a code of 400 or more, or no answer within 10 seconds, counts as a failure. Redirects are not followed. Headers sent:

When a secret is set, PhishTrainer adds the X-Gophish-Signature header, in the form sha256= followed by a hexadecimal signature. This signature is the HMAC-SHA256 of the raw request body, computed with the secret as key. To check a delivery, your application computes this HMAC over the body as received, before any JSON decoding, and compares it with the header value. Reject any request without the header or with a different signature.

The list shows each webhook’s title, URL and state. The Edit Webhook and Delete Webhook buttons act on the row. Deletion cannot be undone. To pause deliveries without losing the configuration, turn off Is active ?.