If you’re a Platinum or Diamond customer, you can use our Smart Groups feature to create dynamic user groups based on a custom set of criteria. This article lists common use cases and the criteria for creating the related Smart Groups.
Jump to:
- Users who have never failed a phishing security test
- Users who have or have not been phished in [X] month(s)
- Users who have or have not been trained in [X] month(s)
- Users who have been recently added and need to take annual or onboarding training
- Users who have failed a phishing security test before training but not after training
- Users who have failed more than [X] phishing test(s) after a specific phishing campaign
- Users who have failed (clicked, replied, opened an attachment, etc.) phishing security tests more than [X] time(s) in the last [X] month(s)
- Users who have reported more than [X] phishing security test(s) (via the Phish Alert Button)
- Users who have clicked more than [X] time(s) in the past [X] month(s)
- Users who haven't completed training in the last [X] month(s) and have failed at least [X] phishing security test(s)
- Users with a specific characteristic (i.e., department, group name, manager's name, location, etc.)
- Users with a personal Phish-prone Percentage greater than X%
- Users in a specific group who have completed one or more specific training assignment(s) and have clicked on a phishing security test after completing their training
- Users in a specific group who have completed one or more specific training assignment(s) and have failed a phishing security test after completing their training
- Users added since/before a specific date
- Users in a specific group who have never taken any training
- Users added in past [X] month(s)/week(s)/day(s)
- Exclude specific users from training or phishing campaigns that are assigned to “All Users”
- Users with a Personal Risk Score greater than or less than X
- Users involved in a custom event
- Users who did not report emails labeled as Threats
- Create manager reporting for specific divisions
- Provide local managers with reporting access for their employees
- Users who have received more than [X] SecurityTips from the [X] real-time coaching campaign(s) in the past [X] month(s)
- Users who have triggered the [X] detection rule more than [X] times in the past [X] month(s)
Users who have never failed a phishing security test
| Rule | Phish Event: User must not have had any failures more than 0 time ever |
This Smart Group could be used to send more challenging phishing security tests to advanced users.
Back to top
Users who have or have not been phished in [X] month(s)
| Rule | Phish Event: User must/[or must not] have delivered more than [desired number] time(s) in [select Relative Date > in the last > desired timeframe] |
This could be useful for ensuring your users are phish tested in equal increments. You could also use this Smart Group to ensure that your users are receiving their phishing security tests in their inboxes.
Users who have or haven't been trained in [X] month(s)
This Smart Group could be useful if you want to ensure your users have been enrolled in training.
| Rule | Training: User has/[has not] completed in any available training in [select Relative Date > in the last > desired timeframe] |
Example
Users who have not completed any training assignments in the last six months
Users who have been recently added and need to take annual or onboarding training
This Smart Group will create a dynamic group of new employees for the purpose of auto-enrolling them into an annual or onboarding training campaign as part of your security awareness training program.
Requirement: You must create this group before creating the annual/onboarding training campaign. When creating this campaign, you must enroll this group and have the Automatically enroll users that are added to the above groups in the future option enabled.
| Rules |
User Date: The user must have been created in [select Relative Date > in the last > desired timeframe] |
|
Training: User has not completed in all of these [select annual training assignment(s)] ever |
Example
Users added to the console in the last week who have not completed the annual training assignment: Kevin Mitnick Security Awareness Training - 45 Min
Users who have failed a phishing security test before training but not after training
This Smart Group could be great for exhibiting the effectiveness of your Security Awareness Training program. You can present this report to management to show how this effect increases with additional training and phishing testing.
Precondition: You must consider the end date of the initial or baseline phishing security test (or another desired phishing test), the training campaign deadline(s), and the specific training content assigned to users in the training campaign(s).
| Rules |
Phish Event: User must have had any failures more than 0 times on or before [select Date Range > All time, through > applicable date]* (the end date of the desired phishing test(s)) |
|
Training: User has completed in any available training on or after [select Date Range > applicable date,** through > Ongoing] (an applicable date, after the initial phishing security test)*** |
|
|
After Training: User must have had any failures after completing: [Select All] |
All Time Option
All Time Option
*Alternatively, you can select a date range to consider when creating this criteria rule for the number of users who have had at least one phishing failure.
**This should be the same date or a date after the date you selected for the first (Phish Event) criteria rule.
***If users were automatically enrolled in remedial training during the phishing campaigns that are considered under the first (Phish Event) criteria rule, the applicable date for this (Training) rule should be adjusted accordingly.
Example
Users who failed at least one phishing security test prior to taking one or more training assignments but did not click on a phishing test after completing their assigned training
Users who have failed more than [X] phishing test(s) during a specific, ongoing phishing campaign
For instance, if you decided to begin testing your users with a more challenging set of phishing templates, you could use this Smart Group as an ad hoc reporting reference to see if failure rates increased or remained the same.
| Rule | Phish Event: User must have had any failures more than [desired number] time(s) on or after [select Date Range > applicable date, through > Ongoing] |
Example
Users who have failed at least two phishing tests after a new phishing campaign that began on 12/29/2018
Users who have failed (clicked, replied, opened an attachment, etc.) phishing security tests more than [X] time(s) in the last [X] month(s)
If you phish test all of your users simultaneously, this Smart Group would be a great tool for ad hoc reporting. It can quickly display the importance of phishing testing users as part of your security awareness training program.
| Rule | Phish Event: User must have had any failures more than [desired number] time(s) in [select Relative Date > in the last > desired timeframe] |
Example
Users who have failed phishing security tests at least two times in the last six months
Users who have reported more than [X] phishing security test(s) using the Phish Alert Button
You can see which users are actively engaging in your security awareness training program and learning how to become a human firewall. You can present this report to management to show how this engagement increases with time and effort.
| Rule | Phish Event: User must have reported more than [desired number] time(s) ever |
Example
Users who have reported at least five phishing security tests
Users who have clicked more than [X] time(s) in the past [X] month(s)
This Smart Group could be a great tool for ad hoc reporting, quickly displaying the efficiency and importance of phish testing users as part of your security awareness training program. This style of Smart Group could even break down the effectiveness of different types of phishing tests (i.e., reply-only templates, templates with attachments, templates with links, etc.).
| Rule | Phish Event: User must have clicked more than [the desired number] time(s) in the last [select Relative Date > in the last > desired timeframe] |
Example
Users who have clicked on at least three phishing security tests in the last six months
Users who haven't completed training in the last [X] month(s) and have failed at least [X] phishing security test(s)
For instance, if you phish test your users on a regular basis and you do not frequently assign training, this Smart Group could be used to assess the status of your current security awareness program. If necessary, you could present this report to management in an attempt to obtain approval for additional mandatory security training.
| Rules |
Training: User has not completed in any available training in [select Relative Date > in the last > desired timeframe] |
|
Phish Event: User must have had any failures more than [desired number] time(s) in [select Relative Date > in the last > desired timeframe] |
Example
Users who have not completed any training assignment(s) in the last six months and have failed at least one phishing test in the last six months
Users with a specific characteristic (i.e., department, group name, manager's name, location, etc.)
For instance, if you want to target all of your Executive team with security awareness training developed specifically for executives or target employees in your accounting department with a PCI-focused training module, you can create this Smart Group and then target it in a training campaign.
| Rule | User Field: The [targeted field] must contain [desired value] |
Example
All users who are in the Accounting group
Users with a personal Phish-prone Percentage greater than X%
You could use this Smart Group to sort your users into different tiers or brackets based on their performances with phishing tests. You could even automate remedial training or additional phishing campaigns for your different tiers of Phish-prone Percentage Smart Groups. If you'd like to learn more about dynamic phishing or automated remedial training click here.
| Rule | User Field: The Phish-prone Percentage must greater than [desired percentage] |
Example
Users who have a personal Phish-prone Percentage greater than 50%
Users in a specific group who have completed one or more specific training assignment(s) and have clicked on a phishing security test after completing their training
This Smart Group could be useful for grouping your vulnerable users by department or position. It can help you identify what users may need to either re-take their training or be provided additional security awareness training or guidance.
| Rules |
User Field: The group name must be equal to [targeted group] |
|
Training: User has completed in any of these [targeted training assignment(s)] in the last [select Relative Date > in the last > desired timeframe] |
|
|
After Training: User must have clicked after completing: [the same targeted training assignment(s) included in the previous rule] |
Example
Users in the "Accounting" group that have completed either the "PCI Simplified" or the "CEO Fraud" training module in the last three months and have clicked on a phishing security test after completing the training
Users in a specific group who have completed one or more specific training assignment(s) and have failed a phishing security test after completing their training
For instance, if you assign specific training modules to different departments or positions, this Smart Group could be useful for defining your vulnerable users who have taken their specialized training.
| Rules |
User Field: The group name must be equal to [targeted group] |
|
Training: User has completed in all of these [targeted training assignment(s)] in the last [select Relative Date > in the last > desired timeframe] |
|
|
After Training: User must have had any failures after completing: [select the same training assignment(s) included in the previous rule] |
Example
Users in the "HTML Developers" group that have completed the "OWASP Top 10 - ILM" or "Ransomware" module and have failed at least one phishing security test after completing their assignments
Users added since/before a specific date
For instance, if you'd like to set up a training or phishing campaign for your employees added after a specific date, perhaps as part of their onboarding process, you could target this kind of Smart Group with an ongoing training campaign.
| Rule | User Date: The user must have been created on or after [select Date Range > desired date, through > Ongoing] |
Example
Users who are added to the console after 12/31/18
Users in specific groups who have never taken a specific training assignment
For instance, if you have several groups that have similar names based on job titles, you could combine all of them into a Smart Group to enroll them in a mandatory training campaign with content specific to their roles.
| Rules |
User Field: The group name must be equal to [targeted groups] |
|
Training: User has not completed in all of these [targeted training assignment(s)] ever |
Example
Users in the "Production" groups who have never taken the "Workforce Safety and Compliance" training module
Users added in past [X] month(s)/week(s)/day(s)
For instance, if you'd like to set up a training campaign for your newest employees as part of their onboarding process, you could target this kind of Smart Group with an ongoing training campaign to automate this process.
| Rule | User Date: The user must have been created in the last [select Relative Date > in the last > desired timeframe] |
Example
Users who have been added to the console within the last month
Exclude specific users from training or phishing campaigns that are assigned to “All Users”
For instance, if you have unmonitored, administrative accounts included in your console, or your IT group is informed about phishing tests prior to them taking place, these user accounts could skew your Phish-prone Percentage or campaign results if you were to include them in a phishing test.
Precondition: All of the users you do not want to be included in phishing/training campaigns must be added to a standard group of ‘inactive’ users or a similarly named group.
| Rule | User Field: The group name must not be equal to 'Inactive Users’ |
Example
Once you've added the nonapplicable accounts to the "Inactive Users" standard group, all applicable users will be members of this Smart Group. Name this Smart Group something like "Phishable and Trainable Users" or “All (Applicable) Users” and assign this group to your training and phishing campaigns instead of using the “All Users” catchall group.
Users with a Personal Risk Score greater than or less than X
Separating users into different tiers or brackets based on their Personal Risk Scores is a great ad hoc reporting feature that can also help improve your security awareness training program.
Personal Risk Scores combine a number of factors to calculate how likely users are to be targeted with a phishing or social engineering attack, how they will react to these types of events, and how severe the consequences would be if they fell for an attack. See our Virtual Risk Officer (VRO) and Risk Score Guide to learn more about Personal Risk Scores.
| Rules |
User Field: The Risk Score must greater than 20 [or other desired Risk Score] |
|
User Field: The Risk Score must less than 40.1 [or other desired Risk Score] |
Example
Harness the Risk Score metric and better train your most "risky" users by automating different tiers of training and phishing based on the Personal Risk Score intervals you create in your Smart Groups. Below is an example of separating users into five Smart Groups based on Risk Scores that coincide with KnowBe4's Personal Risk Score Scale. Please reference this article for instructions on setting up phishing and training campaigns to coordinate with your Smart Groups.
Personal Risk Score Smart Group: Tier 1
Personal Risk Score Smart Group: Tier 2
Personal Risk Score Smart Group: Tier 3
Personal Risk Score Smart Group: Tier 4
Personal Risk Score Smart Group: Tier 5
Users involved in a custom event
If you import user data into the console with the User Event API, you can create Smart Groups based on your custom events. Visit here for examples of custom events that can be used with Smart Groups.
Users who did not report emails labeled as threats
If you integrate your Security Awareness Console with data from PhishER, you can create Smart Groups based on your custom events and the Source of your PhishRIP queries. Visit PhishER Settings for more information on integrating PhishER with your console.
Create manager reporting for specific divisions
You can use smart groups to automatically provide phishing and training reports to immediate managers and other tiers of management as necessary. Please make sure the manager's email address field has been properly updated using user provisioning.
The organization should then upload the full manager username reporting hierarchy to Custom Field 1 as shown below.
Following these steps, create a Smart Group for each manager. The group shown below will contain any users who report up to ManagerUsername6.
Once your Smart Groups have been created, you can generate reports by manager group. These reports can include risk trends, phishing, and training performance.
Provide local managers with reporting access for their employees
Use Smart Groups to add Security Roles to local managers so that they can review groups of users with multiple failures on simulated phishing tests and complete follow-ups with their employees.
You'll need to start by deciding on the reporting requirements and creating Smart Groups to target your desired metrics. After creating your Smart Groups, all managers should be added to a static group for Security Role permissions. You can quickly group all of your managers via CSV Import or Quick Import.
Create a security role and select your static manager group. Under the General tab, add read permissions to Users & Groups with the targeted Smart Groups.
You can also create custom notifications for your managers to include information such as the organization's goal to reduce risk with phishing simulations, the employee's risk to the organization, and instructions for how the manager should proceed. Once the notifications are created, set up a training campaign with the following settings to start after each monthly phishing test:
- Campaign Name: Manager Notification
- End Date: No End Date
- Content: Choose training content for the campaign, such as the Spot the Phish game - this will be available in the Optional library of your users who are in the Reporting Smart Groups.
- Enroll Groups: Targeted Smart Groups from the first step.
- Notification Type: Welcome for Manager and select the custom notification you created next to the manager field.
Start the notification campaign after each monthly phishing campaign closes. Allow the campaign to run for one day, and then close the training campaign to remove the training content from your users’ library. After monthly phishing campaigns close, clone the previous training campaign to send new notifications of which employees have repeated failures.
Users who have received more than [X] SecurityTips from the [X] real-time coaching campaign(s) in the past [X] month(s)
For instance, multiple users may receive SecurityTips from the same real-time coaching campaign. You can create a Smart Group to enroll these users in a mandatory training campaign with content specific to the real-time coaching campaign.
| Rule | SecurityCoach Real-Time Coaching: User must have been sent [select matcher] [select the minimum number of SecurityTips] SecurityTips for the [select the Real-Time Coaching Campaigns] within [select Duration > in the last > desired timeframe] |
Example
Users who received more than 1 SecurityTip from the Risky Online Websites real-time coaching campaign in the last month.
Users who have triggered the [X] detection rule more than [X] times in the past [X] month(s)
For instance, multiple users may trigger the same detection rule. You can create a Smart Group to enroll the users in a mandatory training campaign with content specific to that detection rule.
| Rule | SecurityCoach Detection Rules: User must have triggered [select detection rule] [select Greater Than] [select the minimum number of times the users must have triggered the detection rule] times within [select Duration > in the last > desired timeframe] |
Example
Users who triggered the Risky or Malicious Website Detected detection rule more than once in the last two months.
Back to top
Comments
0 comments
Article is closed for comments.