KnowBe4 PhishER — Phishing Incidents

Manage phishing incidents in KnowBe4 PhishER with bulk remediation actions.

39|17|Updated Feb 4, 2026

Search Tags:#remediation #incident response #phishing #email security #knowbe4 #phisher

Ready to run

npx skills add https://github.com/wyre-technology/msp-claude-plugins --skill knowbe4-phisher-phishing-incidents

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: KnowBe4 PhishER — Phishing Incidents
Source: https://github.com/wyre-technology/msp-claude-plugins/tree/main/msp-claude-plugins/knowbe4/knowbe4/skills/phishing-incidents
Command: npx skills add https://github.com/wyre-technology/msp-claude-plugins --skill knowbe4-phisher-phishing-incidents

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill streamlines the process of managing reported phishing emails within KnowBe4's PhishER platform, enabling efficient investigation, classification, and remediation of email threats.

Core Features & Use Cases

Incident Triage: List, review, and classify new phishing reports.
Detailed Investigation: Retrieve full details of suspicious emails, including headers and links.
Mass Remediation: Perform bulk actions like purging emails or blocking senders across multiple messages.
Use Case: When a user reports a suspicious email, use this Skill to quickly check its details, classify it as a threat, and then purge it from all mailboxes to prevent further spread.

Quick Start

Use the KnowBe4 PhishER skill to list all new phishing messages that are classified as critical threats.

Frequently Asked Questions about KnowBe4 PhishER — Phishing Incidents

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I manage phishing incidents reported to KnowBe4 PhishER?▼

Mass remediation of phishing emails lets you perform bulk actions like purging malicious messages or blocking senders across multiple mailboxes. This prevents further spread of threats reported to the PhishER queue.

What is the process for triaging new phishing reports in KnowBe4 PhishER?▼

Yes, you can retrieve full details of suspicious emails, including headers and links, for detailed investigation. This allows you to verify threat indicators before classifying the message and executing remediation actions.

Do I need API integration to use KnowBe4 PhishER for incident response?▼

Yes, API integration with KnowBe4 PhishER is required for incident response tasks. It enables status updates, retrieves message details, and performs bulk operations necessary for managing suspicious emails.

Can I retrieve full email header details for suspicious messages in PhishER?▼