Phish Focus: Automation Rules

This article takes you through the automation rules that a Phriendly Phishing Admin can setup when emails are sent to Phish Focus Inbox. 

How to set up Automation Rules

When accessing Phish Focus for the first time, the Automation Rule is disabled by default. To enable, go to settings, enable button. 

Note: Automation Rules apply to emails based on their scan results. This allows the system to automatically action emails in the workflow and respond to Learners with immediate feedback.

If all the automation rules are disabled, Phish Focus will use the default rules below for all incoming messages. 

How to Create the rules:

• Admins to click on the rule name and set-up actions for the rule          

•  Admins can configure based on below requirements:

  • • Name (required field): The name of the rule must be unique. 

    • Description: text

    • Status: Active or Inactive - by default it is set to Active

    • The List of actions are based on the scanning result

      • • • • • Admins can set status of the email
              • Admins can set priority of the email
              • Admins can set category of the email
              • Admin must set at least 1 action for the rule

• Admins to set-up the Send Mail function. 

            There are 2 types of emails an Admins can setup when creating new rule or editing a rule:

             Response to user

            Forwarded reported email 

Response to user

• If checked, the system sends a notification email to the reporter when the actions are done on the matching-condition-email.

• If unchecked, the system does not send any notification emails once the action is done.

• Email Settings

  • • From = email address for sending email from Phish Focus. This field is Read only and there is only one account used for all emails.

    • From Name = this is required and can be edited

    • Email content = this is auto populated with the default value, but the email content can be modified prior to sending 

Forwarded reported email

• If checked, the system sends a notification email to the pre-defined email list of IT / SOC specialists when the actions are done on the matching-condition email. This also forwards the original email as an attachment for the IT / SOC specialist to review, analyze and action.

• If unchecked, the system does not send notification emails once the action is done.

• Email Settings
  • • From = email address for sending email from Phish Focus. This field is Read only and there is only one account used for all emails.
    • From Name = this is required and can be edited

    • To = accepts multiple email addresses, hit Enter to validate the address. 

    • CC = accepts multiple email addresses and is not a required field.

    • Checkbox = to include original reporter in the forwarded email

    • Email Content = This is auto-populated with the default value, but the email content can be modified prior to sending