Phishing Reporting Button Workflow
FreeAutomate phishing email reporting and triage.
Free · Opens the source repo
What Phishing Reporting Button Workflow does
The Phishing Reporting Button Workflow skill provides a structured approach to enhancing email security by enabling users to report suspicious emails directly from their email clients. This skill integrates with Microsoft 365's built-in Report button or third-party solutions like KnowBe4 and Cofense, allowing organizations to create a seamless feedback loop between users and their security operations center (SOC). By deploying this skill, organizations can significantly improve their phishing reporting rates and streamline incident response processes.
This skill automates the triage of reported phishing emails using a Security Orchestration, Automation, and Response (SOAR) platform. It extracts indicators of compromise (IOCs) from reported emails, classifies them, and executes predefined remediation actions. For example, confirmed phishing emails can be automatically retracted from all inboxes, while users receive timely feedback on the status of their reports. This rapid response not only mitigates threats but also fosters a culture of security awareness among employees.
The Phishing Reporting Button Workflow is ideal for organizations looking to enhance their email security posture, especially those with compliance requirements or existing phishing simulation programs. By implementing this skill, security teams can better manage user-reported phishing incidents, ultimately reducing the risk of successful phishing attacks. Furthermore, the skill includes mechanisms for tracking reporting metrics and optimizing the workflow based on user engagement and threat intelligence.
In summary, this skill is a comprehensive solution for organizations aiming to improve their phishing reporting capabilities and automate the subsequent incident response actions. It is particularly beneficial for IT security teams who need to establish or enhance their phishing reporting workflows and ensure that users are actively engaged in the security process.
When to use it
Use this skill when implementing phishing reporting capabilities in your email environment or when enhancing existing security workflows.
When not to use it
This skill may not be suitable for environments without Microsoft 365 or a compatible SOAR platform.
What you can build with it
Deploying Phishing Report Button
Implement the phishing report button in Microsoft 365 to enable users to report suspicious emails directly.
Automating Incident Response
Set up automated triage workflows for reported phishing emails to enhance response times and efficiency.
Enhancing Security Awareness
Create a feedback loop that informs users about the status of their reports, improving overall security awareness.
How to install Phishing Reporting Button Workflow
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/building-phishing-reporting-button-workflow --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Building Phishing Reporting Button Workflow
Overview
A phishing reporting button empowers users to flag suspicious emails directly from their email client, creating a critical feedback loop between end users and the security operations center. Microsoft's built-in Report button is now the recommended approach, replacing the deprecated Report Message and Report Phishing add-ins. When combined with automated triage using SOAR platforms, reported emails can be classified, IOCs extracted, and remediation actions taken within minutes. Organizations with effective phishing reporting programs see 70%+ report rates in phishing simulations.
When to Use
- When deploying or configuring building phishing reporting button workflow capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Prerequisites
- Microsoft 365 or Google Workspace with administrative access
- SOAR platform or automation capability (Microsoft Sentinel, Splunk SOAR, Cortex XSOAR)
- Dedicated reporting mailbox for phishing submissions
- Email security gateway with message retraction capability
- Security awareness training platform for feedback loop
Workflow
Step 1: Deploy Phishing Report Button
- Enable Microsoft built-in Report button via Security & Compliance Center
- Configure user reported settings: route to reporting mailbox and Microsoft
- For third-party: deploy KnowBe4 Phish Alert Button or Cofense Reporter
- Verify button appears in Outlook desktop, web, and mobile clients
- Configure report options: Report Phishing, Report Junk, Report Not Junk
Step 2: Build Automated Triage Pipeline
- Configure reporting mailbox monitored by SOAR platform
- Auto-extract IOCs from reported emails: URLs, attachments, sender info, headers
- Submit URLs to VirusTotal, URLScan.io for reputation check
- Submit attachments to sandbox for dynamic analysis
- Check sender against known threat intelligence feeds
- Auto-classify: confirmed phishing, spam, simulation, legitimate
Step 3: Implement Response Actions
- Confirmed phishing: auto-retract from all inboxes, block sender domain
- Confirmed spam: move to junk for all recipients
- Simulation email: mark as correctly reported, credit user
- Legitimate email: return to inbox, notify reporter
- Generate IOC report for threat intelligence team
Step 4: Create Feedback Loop
- Send automated thank-you response to reporter within 5 minutes
- Include classification result when analysis completes
- Track reporter accuracy and engagement metrics
- Recognize top reporters in monthly security newsletter
- Feed reporting metrics into security awareness training program
Step 5: Measure and Optimize
- Track mean time to triage (target: under 10 minutes automated)
- Monitor report volume trends and false positive rates
- Measure user reporting rate in phishing simulations
- Report on confirmed threats caught by user reports vs. gateway
- Optimize automation rules based on classification accuracy
Tools & Resources
- Microsoft Report Button: Built-in Outlook phishing reporting
- Cofense Reporter + Triage: Enterprise phishing reporting and automated analysis
- KnowBe4 Phish Alert Button: Integrated reporting with simulation platform
- Microsoft Sentinel: SOAR automation for triage workflow
- Proofpoint CLEAR: Closed-loop email analysis and response
Validation
- Report button visible and functional across all Outlook platforms
- Reported email arrives in dedicated mailbox within 60 seconds
- Automated triage classifies test phishing email correctly
- Auto-retraction removes confirmed phishing from all inboxes
- Reporter receives feedback notification with classification
- Metrics dashboard shows report volume and accuracy trends
Frequently asked questions about Phishing Reporting Button Workflow
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.