Threat Inbox

Threat Inbox is the new investigation hub for all reports made via the Phishing Report Button.

In one place you can filter, review, and classify reported emails. You can see who reported it, when, what the sender details were, attachments, links, and even header info, all without switching tools.

When the threat is resolved, feedback can be sent back to the employee who reported it, reinforcing the right behaviour and keeping that feedback loop alive.

Overview

Main page

To access this page, navigate to Phishing Report Button / Threat Inbox in the Manager.

Here you will find your reports show up as they are submitted via the Phishing Report Button.

Filtering

You can use the following filters on the left side of the main Threat Inbox page:

Detail view

Basic details & content

Attachments

Review attachment details and copy the file hash

Links

Headers

Resolving a report

When you select Resolve in the Threat Inbox E-Mail overview, a dialog window opens where you classify the email report and optionally send feedback to the reporter. Each classification links to a unique feedback email tailored to respond appropriately. By default, the feedback email sends automatically when you select Resolve and send feedback. To skip sending feedback, deselect the Send feedback email to reporter checkbox.

FAQ

How do I get access to Threat Inbox?

Threat Inbox is only available to Premium and above tiers, as well as those who have the Phishing Reporting Button enabled. To access Threat Inbox, head over to the main navigation menu on the left of the SoSafe manager, and navigate to Phishing Reporting Button / Threat Inbox. If Threat Inbox is activated, you will see your reports ready to be analyzed. If it is not yet activated, you will have the option to do so right on that page:

What do the feedback emails look like?

There are four feedback emails, each unique to the classification category that you can see when you resolve a report. They are ‘Non-Malicious’, ‘Phishing’, ‘Spear Phishing’ and ‘Spam’. These are sent automatically when you classify and resolve an email, unless you uncheck the Send feedback email to Reporter checkbox in the dialog window that appears then you want to resolve a report. Please note that these feedback emails can be previewed via the Preview feedback email button on the main Threat Inbox page, where you will note that each email will contain your company’s logo.

Does Threat Inbox affect the experience of using the Phishing Report Button?

No, not at all. The Phishing Report Button functions exactly the same as it would if Threat Inbox was not activated. However, experience shows that closing the loop via feedback emails encourages secure behavior, making the Phishing Report Button even more effective over time.

I don't need Threat Inbox, how do I set up my Jira or ServiceNow integration?

Threat Inbox is a quick and easy tool to hit the ground running with your report investigations. But it may be the case that you have your own tool (such as Jira or ServiceNow) that would you prefer to use. Simple navigate to Settings / Integrations in the Manager, where you will be able to quickly set yourself up.

Email preview FAQ

In July, we added rich previews of reported emails. This keeps formatting intact, but the email is rendered in a safe, sandboxed views. Links are not clickable and loading of external images is blocked. This is to help make it easier to assess emails without adding risk.

Why do images appear broken or blocked when viewing an HTML email?

External images are intentionally blocked by default to protect admins against tracking pixels and external resource loading during threat analysis.

Does visual rendering expose the admin UI to security risks like malicious scripts?

No. The rendered view is strictly sandboxed to prevent any script execution or interaction with the surrounding application.

Will this change how plain text emails display?

No. Plain text emails will continue to display exactly as they did before with zero changes to existing behavior.