Sense · Phishing Reporting
One button in Outlook. A verdict with a reason.
Users are sensors too. The Report to CTI add-in sends the message (headers, body, attachments) into the same pipeline that handles every other artefact, and shows the reporter what was decided and why. Non-Exchange clients forward to a mailbox and get the same lifecycle.
Outlook add-in
Built to be approved by your mail admin.
An Office.js task pane for Outlook on the web, new and classic Outlook for Windows, and Outlook for Mac. It asks for ReadItem and nothing else, never modifies the mailbox, authenticates with Entra SSO exchanged for a short-lived platform token, and ships both manifest formats for centralised deployment.
Report to CTI
Sends this message to your security team. Nothing in your mailbox changes.
report #2211 · received 09:14
Malicious(credential phishing)
Reason: link resolves to a live Microsoft 365 lookalike registered 3 days ago; DMARC fail on the claimed sender; kit signature matches 2 prior reports.
Pipeline
From the reporter’s click to a minted indicator.
01
Report
One button in Outlook, or forward-as-attachment to the report mailbox from any client.
02
Parse
Full MIME: Received chain, Reply-To, SPF/DKIM/DMARC results, URLs, attachments, with a false-positive gate so relay IPs are never filed.
03
Verify
URLs are probed for liveness and screenshotted; attachments go to static triage and, where a sandbox is connected, detonation. With AI Threat Analysis, a classifier names the impersonated brand and the kit.
04
Verdict
Malicious, suspicious, benign or inconclusive, with the reason, shown to the reporter in the pane.
05
Learn
Confirmed links and senders become indicators and reach the blocklist; the rollup feeds the phishing dashboard and the management report.
What the analyst sees
A report detail page, a queue, and a rollup.
PhishingReports
Queue
Received → parsed → detonating → verdict → closed, with filters, bulk actions and the reporter’s channel.
PhishingReportDetail
Detail
Headers annotated, URLs with liveness and screenshot, attachments with triage and detonation results, the derived IOCs and the verdict reason.
PhishingReportRollupJob
Rollup
Reports by verdict, brand and kit over time: the phishing numbers in the management-body report, or a provider’s monthly client report.
daily limit · audit
Abuse-resistant intake
A per-reporter daily limit, an audit trail of every report and verdict, and a degraded-message path for clients without full MIME access, marked partial.
Phishing beyond reports
Feeds, verification and lookalikes converge.
Dedicated phishing feeds
OpenPhish, PhishTank and PhishStats flow through the same write path with a fast-aging lifecycle.
Verification worker
Every phishing URL, from any source, is probed and classified; dead pages age out, live ones climb.
Brand tie-in
A reported mail pointing at a lookalike of a monitored brand links the report, the lookalike and the takedown.
Customers report too
Report-a-scam, for the people you serve.
Phishing Reporting is for your staff. Your customers get a public report-a-scam form and mailbox, with QR codes decoded in the browser and no name or e-mail stored (part of Brand & fraud protection).
Brand & fraud protection →
Verdicts from your phone
Inconclusive? Decide on the way in.
With Mobile Notifications, a report waiting for a verdict reaches the analyst’s phone. The verdict and its reason are set from the decision board, and the reporter sees them in the pane.
Mobile protection →
Try it in a test mailbox.
Sideload the add-in into a test mailbox, report a real phish and read the verdict in the pane.