Phish Focus : Automation Rules

This article takes you through the automation rules that a Phriendly Phishing Admin can setup when emails are sent to Phish Focus Inbox. 

How to Create the Rules

1. In Phriendly Phishing platform, click . 
2. Once logged in to Phish Focus, go to Automation Rules and click the Rule Name you want to edit. 
   
3. Within the Rule Name enter Rule Information as required.
4. Under Rule details, there are 3 things Admins has visibility or permission to edit.
   1. Details how the rule is triggered and this cannot be modified.
   2. Details what actions are taken for messages received.
      1. Under Message Details, Admins can Set status, Set priority, Set category. 
         
      2. Admins can Enable Phish Clear from here for this rule only.
      3. Admins can Enable Block List from here for this rule only.
   3. Modify the email response that is sent to the reporter and / or SOC Team. Proceed to How to create or set-up the Email Response template
      

How to create or set-up the Email Response template

There are 2 types of Email Responses Admins can set-up when creating or editing an Automation Rule:

1. Response to user 
   
2. Forwarded reported email  

Response to user

• If is checked, the system sends a notification email to the reporter when the actions are done on the matching-condition-email.
• If is unchecked, the system does not send any notification emails once the action is done.
• Click to modify or check below fields:
  1. From 
     
     1. From = email address for sending email from Phish Focus. This field is Read only and there is only one account used for all emails.
     2. From Name = this is required and can be edited
  2. Subject 
     
  3. Email content = this is auto populated with the default value, but the email content can be modified prior to sending 
     

Forwarded reported email

• If is checked, the system sends a notification email to the pre-defined email list of IT / SOC specialists when the actions are done on the matching-condition email. This also forwards the original email as an attachment for the IT / SOC specialist to review, analyze and action.
• If is unchecked, the system does not send notification emails once the action is done.
• Click to modify below fields:
  1. From 
     
     1. From = email address for sending email from Phish Focus. This field is Read only and there is only one account used for all emails.
     2. From Name = this is required and can be edited
  2. To = accepts multiple email addresses, hit Enter to validate the address. 
  3. CC = accepts multiple email addresses and is not a required field.
  4. Subject 
     
  5. Email Content = This is auto-populated with the default value, but the email content can be modified prior to sending