About

Imported from mukul975/anthropic-cybersecurity-skills (skills/building-phishing-reporting-button-workflow/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill building-phishing-reporting-button-workflow. Copyright stays with the author (Apache-2.0).

Building Phishing Reporting Button Workflow

Name: building-phishing-reporting-button-workflow
Author: mukul975

Overview

A phishing reporting button empowers users to flag suspicious emails directly from their email client, creating a critical feedback loop between end users and the security operations center. Microsoft's built-in Report button is now the recommended approach, replacing the deprecated Report Message and Report Phishing add-ins. When combined with automated triage using SOAR platforms, reported emails can be classified, IOCs extracted, and remediation actions taken within minutes. Organizations with effective phishing reporting programs see 70%+ report rates in phishing simulations.

When to Use

When deploying or configuring building phishing reporting button workflow capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Microsoft 365 or Google Workspace with administrative access
SOAR platform or automation capability (Microsoft Sentinel, Splunk SOAR, Cortex XSOAR)
Dedicated reporting mailbox for phishing submissions
Email security gateway with message retraction capability
Security awareness training platform for feedback loop

Workflow

Step 1: Deploy Phishing Report Button

Enable Microsoft built-in Report button via Security & Compliance Center
Configure user reported settings: route to reporting mailbox and Microsoft
For third-party: deploy KnowBe4 Phish Alert Button or Cofense Reporter
Verify button appears in Outlook desktop, web, and mobile clients
Configure report options: Report Phishing, Report Junk, Report Not Junk

Step 2: Build Automated Triage Pipeline

Configure reporting mailbox monitored by SOAR platform
Auto-extract IOCs from reported emails: URLs, attachments, sender info, headers
Submit URLs to VirusTotal, URLScan.io for reputation check
Submit attachments to sandbox for dynamic analysis
Check sender against known threat intelligence feeds
Auto-classify: confirmed phishing, spam, simulation, legitimate

Step 3: Implement Response Actions

Confirmed phishing: auto-retract from all inboxes, block sender domain
Confirmed spam: move to junk for all recipients
Simulation email: mark as correctly reported, credit user
Legitimate email: return to inbox, notify reporter
Generate IOC report for threat intelligence team

Step 4: Create Feedback Loop

Send automated thank-you response to reporter within 5 minutes
Include classification result when analysis completes
Track reporter accuracy and engagement metrics
Recognize top reporters in monthly security newsletter
Feed reporting metrics into security awareness training program

Step 5: Measure and Optimize

Track mean time to triage (target: under 10 minutes automated)
Monitor report volume trends and false positive rates
Measure user reporting rate in phishing simulations
Report on confirmed threats caught by user reports vs. gateway
Optimize automation rules based on classification accuracy

Tools & Resources

Microsoft Report Button: Built-in Outlook phishing reporting
Cofense Reporter + Triage: Enterprise phishing reporting and automated analysis
KnowBe4 Phish Alert Button: Integrated reporting with simulation platform
Microsoft Sentinel: SOAR automation for triage workflow
Proofpoint CLEAR: Closed-loop email analysis and response

Validation

Report button visible and functional across all Outlook platforms
Reported email arrives in dedicated mailbox within 60 seconds
Automated triage classifies test phishing email correctly
Auto-retraction removes confirmed phishing from all inboxes
Reporter receives feedback notification with classification
Metrics dashboard shows report volume and accuracy trends

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-building-phishin-a9cc93/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-building-phishin-a9cc93.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-building-phishin-a9cc93",
  "kind": "skill",
  "name": "building-phishing-reporting-button-workflow",
  "description": "Implement a phishing report button (Microsoft 365 built-in Report button or third-party like KnowBe4/Cofense) in email clients with a SOAR-driven automated triage workflow that classifies reported emails, extracts IOCs, takes remediation actions, and gives feedback to reporters. Use when deploying user-reported phishing intake or automating triage of the resulting reporting mailbox.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "math"
    ],
    "tags": [
      "skill-md",
      "phishing-reporting",
      "email-security",
      "incident-response",
      "security-awareness",
      "outlook",
      "microsoft-365",
      "soar",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Implement a phishing report button (Microsoft 365 built-in Report button or third-party like KnowBe4/Cofense) in email clients with a SOAR-driven automated triage workflow that classifies reported emails, extracts IOCs, takes remediation actions, and gives feedback to reporters. Use when deploying user-reported phishing intake or automating triage of the resulting reporting mailbox."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/building-phishing-reporting-button-workflow/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/building-phishing-reporting-button-workflow/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/building-phishing-reporting-button-workflow/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Building Phishing Reporting Button Workflow\n\n## Overview\nA phishing reporting button empowers users to flag suspicious emails directly from their email client, creating a critical feedback loop between end users and the security operations center. Microsoft's built-in Report button is now the recommended approach, replacing the deprecated Report Message and Report Phishing add-ins. When combined with automated triage using SOAR platforms, reported emails can be classified, IOCs extracted, and remediation actions taken within minutes. Organizations with effective phishing reporting programs s",
  "cost": {
    "context_tokens": 982
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-building-phishin-a9cc93/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.