Phishing Report Button email forwarding & triage

You can configure the SoSafe Phishing Report Button to forward reported emails (including the .EML file) to an abuse mailbox, MS Defender and/or SoSafe’s in-house triage tool - Threat Inbox.

Abuse mailbox

Compatibility

• Outlook: all APIs are supported
• Google Workspace: not supported

How it works

When users report suspicious emails, the Phishing Report Button can forward these message to a specified abuse mailbox. Your sandbox system of choice can then monitor this mailbox and analyze incoming emails for threats such as phishing links or malware. If a threat is detected, it can automatically quarantine the corresponding email and remove any forwarded copies from user inboxes.

Setup

1. Set up an abuse mailbox in your security solution. For detailed instructions, refer to your provider's documentation.

2. In the SoSafe Manager, navigate to Phishing Report Button / Report handling and scroll to the Set up abuse mailbox section. Activate the toggle.

   

    

    

3. Enter your abuse mailbox address and select Save to confirm.

Technical details

• Forwarded emails include special headers (references and in-reply-to) that link back to the original email. This allows security tools to track conversations and analyze the message trail.

• The forwarded email does not contain the original email as an attachment.

• Instead, the forwarded email contains basic plaintext metadata of the original email.

MS Defender

You can integrate the Phishing Report Button with Microsoft Defender for report handling. This means emails reported with the PRB show up in your SOC team's submissions dashboard in Defender. If you are on the Microsoft Defender for Office 365 Plan 2, you can also trigger an Automated Investigation and Response (AIR) for both analysis of the reported email and remediation suggestions. Learn more about this capability at  https://learn.microsoft.com/en-us/defender-office-365/air-auto-remediation.

Requirements and limitations

All APIs available for the PRB are supported. However, Exchange Web Services (EWS) limits the size of attachments to 500kB, meaning that we cannot attach the original email as an .eml file if it is too large. In these cases, while the reports are sent to the user submission inbox, they will not appear in the Microsoft Defender user submission dashboard. We therefore do not recommend using this integration with the EWS API.

Microsoft Defender submissions do not work when reports are submitted from an on-premise mailbox or from outside the organization. Reporters must be on the same Azure instance of MS Defender.

Setup in Microsoft Defender

1. Go to the Microsoft Defender portal. Navigate to System / Settings / Email & collaboration / User reported settings. You can also go to this page directly: https://security.microsoft.com/userSubmissionsReportMessage
2. Make sure the checkbox for Monitor reported messages in Outlook is checked.
3. Select Use a non-Microsoft add-in button.

4. Under Reported message destinations, make sure Send reported messages to: is set to Microsoft and my reporting mailbox.
5. Under Add an exchange online mailbox to send reported messages to: enter the inbox you want to use.

Setup in the SoSafe Manager

In the SoSafe Manager, navigate to Phishing Report Button / Report handling and find the section for Microsoft Defender emails. Select the toggle to activate it and enter the same inbox you specified earlier. Select Save to confirm.

User-reported emails will now be forwarded to your User submissions dashboard in Defender (navigate to Investigation & response / Actions & submissions / Submissions). You can learn more about what you can do there on Microsoft’s support pages. Simulated phishing emails sent by SoSafe will not be forwarded.

Threat Inbox

Threat Inbox is your central hub for triaging reports submitted by your users via the SoSafe Phishing Report Button (PRB). Rather than managing reports through a standard email inbox, Threat Inbox provides a dedicated environment to search, filter, review, classify potential threats, act on them, and give the employees who reported them meaningful feedback that reinforces secure behaviour across your organization.

Threat Inbox can also work through your queue for you. AI analysis suggests a tag for every report as it arrives. Mailbox remediation moves a reported email out of the recipient's inbox and, on Google Workspace, can also block the sender. Both are optional and switched off until you turn them on.

Key features

Threat Inbox allows you to perform deep-dive investigations into reported emails directly in the SoSafe Manager.

• Detail views: Access high-level context including the reporter's identity, timestamp, and full sender details.

• Technical deep dives: Review full email headers, link destinations, and attachment details.

• File inspection: For emails with attachments, you can quickly view file details and copy file hashes for further cross-referencing in your internal security tools.

• AI analysis: If you have switched AI analysis on, each report arrives with a suggested tag of Safe, Spam or Malicious for you to review. Suggestions are advisory. You make the final decision.

• Plain-English explanation: Open a report and you can read why the AI reached that suggestion, written in plain language and specific to that email.

• Mailbox remediation: If you have connected a Google Workspace or Microsoft integration, you can act on the email itself rather than just the record. Move it out of the recipient's inbox into your provider's spam or trash folder and, with Google Workspace, block the sender or the sending domain.

• Reduced overhead on reported emails: If you hesitated to deploy the SoSafe Phishing Report Button in the past, you can now do so knowing there is a clear way to manage reported emails without creating more overhead.

Smart filtering & triage

To help your team stay organised, Threat Inbox provides several views to help you prioritize the most critical threats. You can also sort the queue, search it, and act on several reports at once.

Search. Search the queue by email subject, by the reporter's email address, or by date.

Bulk resolve. Select several reports and resolve them all in one action rather than opening each one. Selecting everything applies only to the reports matching the filter you currently have active, not to the entire queue. You see how many reports are selected and confirm before the action applies. A feedback email is sent to each reporter where feedback is switched on, and any comment you add is included in all of them. You can still change a report's classification after it has been resolved, which sends the reporter another feedback email. You can also still download the .EML file after resolving.

Filter by AI analysis. If you have switched AI analysis on, you can also filter the queue by tag and jump straight to everything tagged Malicious. These filters only appear while AI analysis is switched on. If you switch it off, the filters disappear and the views above behave exactly as they did before.

When you switch AI analysis on, Threat Inbox works through your entire backlog and adds AI analysis to existing reports.

AI analysis is optional and off until you turn it on.

When it is on, a reported email is first stripped of personally identifiable information. Multiple data points from what remains, including the sender, the links and any attachments, are cross-checked against industry-standard threat intelligence databases. In most cases this is enough to determine whether an email is Safe, Spam or Malicious.

A privacy-first AI layer then reviews the result, to add confidence where reputation data alone is not conclusive.

The outcome is always a suggestion: a Safe, Spam or Malicious tag. Your team reviews it and confirms it when you resolve the report. If you disagree, classify the report yourself.

Closing the feedback loop

Providing feedback to users turns a closed ticket into a teaching moment and provides motivation for further reports. When you select Resolve on a report, you classify the email into one of three categories: Safe, Spam or Malicious.

If AI analysis is switched on, each report in your review queue carries a suggested tag when you open it: Safe, Spam or Malicious. The tag is the AI's suggestion and has not been confirmed. Once you resolve the report, the classification is yours. You can accept the suggestion or choose a different one.

• Automated feedback: Each classification is linked to a unique feedback email that explains the classification to the employee. Feedback emails use a standard set of templates, and you can add a comment for the reporter when you resolve.

• Behavioral reinforcement: Sending these updates ensures users feel heard and valued, which improves future reporting rates and data quality.

• Admin flexibility: While feedback is sent automatically by default to save your team time, you can easily opt-out by deselecting the Send feedback email checkbox for specific cases.

Classifying a report records a decision. Mailbox remediation acts on the email itself.

What mailbox remediation can do depends on whether your organisation uses Microsoft 365 or Google Workspace, so not every action below is available in every environment. From a report in Threat Inbox you can:

• Move the email out of the recipient's inbox. Spam goes to your provider's own spam folder (Spam in Gmail, Junk Email in Outlook). Malicious goes to your provider's own trash (Trash in Gmail, Deleted Items in Outlook). SoSafe does not create its own folders. The email is moved, not deleted by SoSafe, but your provider's normal rules for that folder then apply, including any automatic clean-up.

• Block the sender*, so further emails from that address do not reach your users.

• Block the sending domain*, so further emails from anywhere on that domain do not reach your users.

*Google Workspace only.

One limit is worth knowing before you rely on it. Mailbox remediation reaches the copy that was reported, and is not an organisation-wide sweep. If the same email was delivered to fifty people and one person reported it, mailbox remediation acts on that one person's copy.

Mailbox remediation is triggered by you on an individual report.

Set up. Connect mailbox remediation under Settings / Integrations. You can have one mailbox remediation integration connected at a time. The permissions it needs are shown on your email environment's consent screen when you approve the connection. Use. When you resolve a report, from the resolve window or the report's detail view, tick the mailbox remediation actions you want. Mailbox remediation only runs on the reports you choose it for.

Mailbox remediation is not the same as the Delete emails permanently after reporting setting, found under Phishing Report Button / General settings. That setting acts on every report at the moment it is submitted, and it deletes. Mailbox remediation acts on a single report after it has been reviewed, and it moves. If you also forward reports to an abuse mailbox, check that your sandbox can still reach your provider's spam and trash folders.

If you switch Threat Inbox off, every reported email and every classification record is permanently deleted. You will be asked to confirm this before it happens.

To access the hub, navigate to Phishing Report Button / Threat Inbox within the SoSafe Manager. If the feature is not yet active, you will find an activation toggle directly on that page.

While the Threat Inbox is designed to be a complete investigation solution, we understand many teams use external ticketing systems. If you prefer to triage reports through tools like Jira or ServiceNow, you can configure these connections under Settings / Integrations.