Creating and Managing PhishER Actions

The Actions tab of your PhishER platform contains all of your actions. Each action is a process that PhishER follows to manage messages in your PhishER Inbox. For example, you can create actions to automatically disposition messages and send reports to your users. You can also manage your actions from the Actions List tab.

See the subsections below to learn how to create and manage actions.

Jump to:
Creating Actions

Managing Your Actions

Creating Actions

To create a new action, follow the steps below:

1. Log in to your PhishER platform.
2. From the sidebar on the left side of the page, select the Actions tab to open the Actions List page.
3. Click the New Action button in the top-right corner of the page. The Action Details page will open.
   
4. In the Name and Description fields, enter a meaningful name and description for your action. The name and description can help you or other admins easily recognize the purpose of the action.
5. Use the options in the drop-down tabs to set up your action (Click to view). For more information about these tabs, click the drop-down menus below:
   ×

   Action Details Steps

   

   Close
   1. Choose how this action should be triggered

   

   • Every Message: Select this option to trigger this action for all messages.
   • No Tags: Select this option to trigger this action for all messages without a tag.
   • Specify Tags: Select this option to trigger this action for specific tags. When you select the check box, the Has and Doesn't Have options will display. For either option, you can select All, Any, or Only. Then, add the tags you want to trigger this action. To add a tag, click Add new tag field. Enter the tag you want to use, then press Enter on your keyboard.

     

   • Manual Trigger Only: Select this option to only allow this action to be triggered manually. To manually trigger the action, you'll need to select it from the Run drop-down menu on the Inbox page or Message Details page.

   2. Choose the action to be taken on matched messages

   

   Note: Select the check box next to an option to enable the drop-down menu.

   • Set Status: Select this check box to assign a status to messages. When you select this option, a drop-down menu will display for you to select a status. You can select Received, In Review, or Resolved.
   • Set Priority: Select this check box to assign a priority to messages. When you select this option, a drop-down menu will display for you to select a priority. You can select Critical, High, Medium, Low, or Unknown priority.
   • Set Category: Select this check box to assign a category to messages. When you select this option, a drop-down menu will display for you to select a  category. You can select Clean, Spam, Threat, or Unknown.
   • Add Tags: Select this check box to assign custom tags to messages. To add a tag, click the Add new tag field. Enter the tag you want to use, then press Enter on your keyboard.

   3. Choose how you would like to report this action

   

   • None: Select this option if you do not want this action to be reported.
   • Send to Syslog: Select this option to send a report of this action to a syslog server. If you select this option, a drop-down menu will display for you to select a specific syslog server if you have configured one or more servers. If you have not configured a server, a link to your syslog settings will display instead. See our PhishER Settings and Whitelisting in Syslog articles to learn how to integrate a Syslog server with PhishER.
   • Send Email: Select this option to send a report of this action to a specific email address. If you select this option, you can select an existing custom email template or create a new email template to use for this report.
     Note: If you would like to have the fields of your email template populate automatically, you can configure your email server settings accordingly.
     For more information about using the email template editor, see our How to Create a Custom Email Template in PhishER article.

   • 

   • Send to KMSAT: Select this option to send a report of this action to your KMSAT console. Selecting this option will display the messages affected by this action on the User Timeline. The User Timeline will include whether the message is read or unread, the folder the message was found in, the message's category, and if the message was reported to PhishER. Selecting this option will also allow you to use the message ID from KMSAT to search PhishER for messages that your users report.
     
     Note: This option will be disabled until you have entered your KMSAT User Event API Key into your PhishER Settings.

   

   • Send to Webhook: Select this option to send a report of this action to a webhook. You can use this option to see how the action will appear when it is sent to the selected webhook. When the action is triggered, the webhook will display the message details of each reported message.

   

   4. Choose whether or not to halt further actions

   

   Select this check box to halt further actions. If this action is triggered, each action ordered below this action will not run. This action will also have a hand icon next to the Trigger Tags column on the Actions List page.

   5. Choose QuickActions settings

   

   Note: You can add up to eight actions to your QuickActions bar.

   • Include this action in the QuickActions bar: Select this check box to display this action in the Quick Actions bar (Click to view) on the Inbox page or Message Details page. QuickActions allow you to trigger actions manually. For example, if you manually disposition a message as Clean, you can create a QuickAction to send an email to the user who reported the original email to let them know that the message is safe.
   • Add keyboard shortcut for this Action: Select this check box to add a keyboard shortcut for this action. This option will allow you to press a key on your keyboard to trigger the action.
     Note: Each action must have a unique keyboard shortcut. You cannot use the same shortcut for multiple actions.
   • Automatically move to Next item in list after Action completes: Select this check box to move to the next message after this action completes.

   ×

   Quick Actions

   

   Close

   6. Choose whether or not to permanently delete matching messages

   

   • Select this check box to permanently delete any new matching messages with the associated tags from your PhishER Inbox when the action is triggered or run.
     Note: Any past messages that also have the associated tag will not be found or deleted when this action is triggered or run.

   7. Find Similar Messages

   Note: If you choose to have this action triggered for all messages, this section will be grayed out.

   

   • Match Criteria: Select one or more criteria options to find similar messages. You can select Subject, Sender, Recipients, Attachments, or Body. If you select one of these options, you’ll need to set the value for that option.
   • Find messages received in the: From the drop-down menu, select a timeframe for PhishER to look for messages received in the Inbox.
   • Automatically quarantine all found messages: Select this check box to create a new PhishRIP query when the action is triggered.
   • Automatically PhishFlip all found messages: If you select Automatically quarantine all found messages, you can also select this check box to create KMSAT phishing templates by flipping found messages with PhishFlip.
   • Create a KMSAT Phishing Template: Select this check box to make specific KMSAT phishing templates for the emails that trigger the action.
6. (Optional) If you would like your action to be inactive when it is created, turn off the Active Status toggle in the top-right corner of the Action Details page. By default, your action will be active.
   Note: For your action to trigger, it must be active.
   
   
7. Click the Save Action button at the bottom of the page. Your action will display on the Actions List page.
8. (Optional) If your actions need to be in a different order on the Actions List, drag and drop your new action to a different position. Then, click the Save Action Order button.
   

Back to top

Managing Your Actions

All of your actions will be listed on the Actions List page. PhishER runs your actions in order, from top to bottom. You can drag and drop your actions to change their order.

For more information about the Actions List, see the screenshot and list below:

1. Name: This column displays the custom name of the action.
2. Description: This column displays a custom description of the action.
3. Status: This column displays the current state of the action. An action can have a status of Active or Inactive. To change the status of an action, click on the action. Then, toggle the Active Status or Inactive Status toggle in the top-right of the Action Details page.
4. Last Updated At: This column displays the date and time when a change was last made to the action.
5. Trigger Tags: This column displays the tags that will trigger the action to take place.
6. Actions: This column displays the actions available to run on an action entry. You can click the trashcan icon to delete the action.

Back to top