Phishing¶

The Phishing module lets users report suspicious emails directly from Outlook via the PolicyClue add-in. Reported emails are stored as attachments on alerts and analyzed by an automated sandbox, then triaged by admins in a dedicated view. It requires an active subscription.

Reporting an email¶

Once the Outlook add-in is deployed, users see a Report Email button in the Outlook ribbon. Behavior depends on the ribbon type:

Exchange Online (Standard) — the button appears in Outlook's dedicated Report section. Clicking it opens a small dialog that briefly explains the difference between phishing (malicious — analyzed and removed) and spam (unwanted but not harmful — just removed). By default the email is treated as phishing and analyzed. The user can override with two optional checkboxes:
- I don't think this email is malicious — it's just annoying spam (no phishing)
- Email me the result when our security team has reviewed this (only for phishing)
A text box at the bottom lets the user optionally explain what made the email suspicious. The comment is shown to the security team during triage. - Exchange On-Premises (Legacy) — two separate buttons appear: Report Phishing and Report & Get Feedback. Spam reporting is not available on the legacy ribbon.

Clicking the report button:

Retrieves the complete email (headers, body, and all attachments).
Sends it to PolicyClue as either a phishing_reported or spam_reported alert.
Deletes the email from the user's inbox (moved to Deleted Items).

No Graph API access or Entra app registration is required.

When the user ticks Email me the result (and leaves the spam box unchecked, so it is treated as phishing), the alert is flagged for follow-up. Administrators send a verdict reply from the Triage page; if the verdict is not phishing, the original email is attached to the reply so the user can read it again. Spam reports never request follow-up by design.

Overview Dashboard¶

Phishing → Overview shows analytics on user reporting activity. Totals include phishing and spam so admins can see overall reporting volume:

KPI cards: total reports, unique reporters, unique reported senders.
Timeline chart of report volume over time.
Top reporters and top reported senders.
Activity table with recent reports.

Triage¶

Phishing → Triage is the dedicated workflow for reviewing open phishing reports. Spam reports are excluded — they are removed from the inbox and counted in the Overview dashboard, but they don't need admin review.

Left panel — scrollable list of open phishing reports showing subject, sender, reporter, and risk score. Reports with pending sandbox analysis are highlighted.
Right panel — selected report detail: email metadata, reporter context, the user's reason/comment, risk assessment, the Phishing Indicators checklist, the email body rendered in a sandboxed frame, an expandable Email Headers table, attachments with risk scores and tags, a Similar Reports cluster from the last 30 days, a comment thread with Save Comment, and the triage action buttons.

Reporter context¶

Next to the reporter address, the page shows a 90-day track record: how many reports the user submitted, how many were confirmed as phishing vs marked safe, and how many are still open. After three decided reports, a Reliable reporter badge appears for users with a true-positive rate of at least 70%, and a Noisy reporter badge for those below.

Phishing Indicators¶

A deterministic checklist of signals derived from the reported email's headers and body, separate from the sandbox risk score:

SPF / DKIM / DMARC verdicts from the email's authentication headers.
Display name spoofs known brand — when the friendly From name contains a known brand but the sender domain doesn't match.
Reply-To / Return-Path mismatch — when those headers point to a different domain than the From address.
Urgency phrasing — when common urgent-action phrases (English + German) appear in the body.

Each indicator carries a one-line explanation so the analyst can corroborate the verdict without reading the raw headers.

Email body preview¶

The reported email's HTML body is rendered inside an isolated frame — no JavaScript runs, no forms submit, no top-level navigation. External image references are stripped before rendering so opening the body in the triage view does not signal the phisher that the email has been read.

The plain-text body is shown instead when no HTML part is present.

Similar Reports¶

When other users have reported a message in the last 30 days with the same sender domain or a closely matching subject, those reports are listed here with their verdict. Click any row to jump to that report — handy for confirming a wave is the same campaign before triaging it the same way.

Comments¶

Each report has its own comment thread, identical to the alert inspector. Use Save Comment to record an observation, a colleague handoff, or any context the team should see later — without closing the report.

When you click Confirm as Phishing or Close as Safe, any text in the comment field is saved as a comment first, then the alert is closed. Leave the field empty to triage without adding a comment.

Risk Assessment¶

Based on the sandbox risk score (0–10):

Likely Phishing (score > 7) — red indicator.
Suspicious (score 3–7) — amber indicator.
Likely Safe (score ≤ 3) — green indicator.
Pending Analysis (no score yet) — gray indicator with spinner.

Triage actions¶

For reports where the user requested feedback:

Not Phishing — Reply to User — closes the alert, marks it as not phishing, and sends a feedback email to the reporter with the original email attached.
Confirmed Phishing — Reply to User — closes the alert, marks it as phishing, and sends a confirmation email to the reporter.

For reports without feedback requested:

Close as Safe / Confirm as Phishing — same actions without sending an email.

Alert types¶

Alert type	Description
Phishing reported	A user reported an email as phishing. Analyzed by the sandbox; appears in the Triage queue.
Spam reported	A user reported an email as spam. Removed from the inbox; not analyzed; counted in the Overview dashboard.

Attachments¶

Each phishing report includes the complete email and its extracted parts:

Reported email — the full original email including headers, body, and all attachments.
Extracted parts — the sandbox automatically extracts the email into individual parts (body, file attachments) and adds them as separate attachments on the alert for independent scanning and URL extraction.
Risk score — pending until analyzed by the sandbox, then a value from 0 to 10.

Attachments are encrypted at rest. Only metadata (name, type, size, risk score) is indexed for search. Attachments are visible in the alert inspector with a download button.

Sandbox analysis¶

When sandbox analysis is enabled by your administrator, reported attachments are automatically submitted for malware analysis. For email files, the body and embedded attachments are extracted and scanned individually. URLs found in HTML email bodies are also submitted.

Each scanned attachment receives a risk score (0–10). The alert inspector displays risk scores with color-coded badges:

0–3 — green (low risk)
3–7 — yellow (medium risk)
7–10 — red (high risk)
Pending — grey (not yet analyzed)

Sandbox connectivity is configured at deployment time; see Deployment.

Webhook integration¶

Alert payloads (including attachments) are sent to configured webhooks. See Webhooks for configuration.