skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

building-phishing-reporting-button-workflow

Implement phishing report buttons in email clients with automated SOAR triage and reporter feedback.

954|172|Updated Mar 13, 2026
Search Tags:#incident response#security awareness#Outlook#soar#email security#Microsoft 365#phishing reporting
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill building-phishing-reporting-button-workflow
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: building-phishing-reporting-button-workflow
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/phishing-defense/building-phishing-reporting-button-workflow
Command: npx skills add https://github.com/xalgord/xalgorix --skill building-phishing-reporting-button-workflow

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

User-reported suspicious emails often land in unmonitored mailboxes with no triage, no remediation, and no feedback to reporters, causing security teams to miss real threats and user reporting rates to decay.

Core Features & Use Cases

  • Report Button Deployment: Configure the Microsoft built-in Report button or third-party tools like KnowBe4 Phish Alert Button and Cofense Reporter across Outlook desktop, web, and mobile.
  • Automated Triage Pipeline: Monitor a dedicated reporting mailbox with a SOAR platform, extract IOCs (URLs, attachments, headers), check reputation via VirusTotal and URLScan.io, and auto-classify emails as phishing, spam, simulation, or legitimate.
  • Response and Feedback Loop: Auto-retract confirmed phishing from all inboxes, block sender domains, credit users for simulation reports, and send classification feedback to reporters within minutes.
  • Use Case: A security team deploys the Microsoft Report button, routes submissions as .eml attachments to a reporting mailbox monitored by Microsoft Sentinel, and verifies end-to-end that a test phish triggers case creation, IOC extraction, retraction, and reporter notification.

Quick Start

Set up a phishing reporting button workflow for my Microsoft 365 environment with automated triage and reporter feedback.

Frequently Asked Questions about building-phishing-reporting-button-workflow

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up a phishing report button in Outlook?▼

Enable the Microsoft built-in Report button through the Security & Compliance Center, then configure user reported settings to route submissions to both Microsoft and your dedicated reporting mailbox. Verify the button appears in Outlook desktop, web, and mobile clients.

How to automate triage of user-reported phishing emails?▼

Connect a SOAR platform such as Microsoft Sentinel, Splunk SOAR, or Cortex XSOAR to the reporting mailbox. Auto-extract IOCs like URLs, attachments, and headers, submit them to VirusTotal and URLScan.io, and classify messages as phishing, spam, simulation, or legitimate.

Microsoft Report button vs KnowBe4 Phish Alert Button?▼

The Microsoft built-in Report button is now the recommended native approach, replacing the deprecated Report Message and Report Phishing add-ins. Third-party options like KnowBe4 Phish Alert Button or Cofense Reporter integrate reporting with their simulation and triage platforms.

Why are reported phishing emails losing headers and attachments?▼

Reports forwarded as plain text strip the headers, URLs, and Reply-To data needed for IOC extraction. Configure submission as an .eml or .msg attachment so the original message content survives for analysis.

How do I stop phishing simulation emails from creating real incidents?▼

Allowlist simulation headers from platforms like GoPhish or KnowBe4 in your triage pipeline. This credits the user for correctly reporting the simulation instead of generating noisy real incidents in the SOAR queue.

Related Skills

Explore More Software Engineering Skills→
salamientarksalamientark

ms365-tenant-manager

Generate PowerShell scripts for Microsoft 365 tenant administration and policy enforcement.

Community
Advanced
wyre-technologywyre-technology
39

Abnormal Security Threats

Investigate and remediate Abnormal Security email threats like BEC and phishing.

Official
Advanced
wyre-technologywyre-technology
39

KnowBe4 Training Campaigns

Manages and analyzes KnowBe4 phishing simulation and security awareness training campaigns.

Official
Intermediate
AxxxxxxaaannAxxxxxxaaann

building-automated-malware-submission-pipeline

Automates malware submission and triage workflows for scalable threat analysis.

Community
Advanced