Phish Alert Button (PAB) Guide for Outlook, Exchange, Office 365, and GSuite

The Phish Alert Button (PAB) add-in for Microsoft Outlook, Exchange, Office 365, and Google Apps/GSuite gives end-users the ability to report suspicious emails. PAB allows your employees to take an active role in managing the problem of Phishing and other types of malicious emails. This will provide IT with early warning of possible phishing attacks or malicious emails to take effective action to prevent security or network compromise.

If you want to know how a PAB installation can benefit your organization or best practices for implementation, visit our Best Practices for PAB Implementation article.

Paid Integration: If you are using our full-featured Phishing console, the PAB will also track if your users report our simulated phishing emails, so you can see which users are successfully identifying potentially malicious emails.

Jump to:
PAB installation guides
Enable and configure PAB
Multiple PAB instances
PAB reporting
Data the add-in sends to our servers
PAB compatibility matrix

PAB installation guides

Installation of the PAB depends on the mail environment in your organization. Below are our main installation guides:

• Exchange (Server-based) install
• Office 365 (Server-based) install
• Outlook (Client-based) install
• GSuite extension install (Chrome)

In addition to our installation guides, you can review our PAB installation video tutorial:

• PAB Installation and User Experience

Back to top

Enable and configure PAB

Step 1: Log in to your KnowBe4 account and navigate to your Account Settings screen. This screen will look different depending on your account version.

• Free Version: Log in to your console and click the "Get Started" button. This will take you to the Phish Alert Enabled screen. Skip to Step 3 for further instruction.

  

• Paid Version: Log in to your console and click on your email address in the top-right corner of the screen. Choose “Account Settings” to enter the Account Settings area.

  

Step 2: Scroll down to the Phish Alert section and check the Phish Alert Enabled checkbox.

Step 3: Configure your PAB by filling out the corresponding fields. Each field is described below.

1) Enabled - check this box if you want to enable Phish Alert for your account. If the checkbox is not checked but you have deployed Phish Alert in your organization, no reporting will be recorded.

2) License Key - this is the license key you will use to install Phish Alert on your workstations. For Google Apps/GSuite Chrome Extension installations, you will not need this, as it is built into your .json Config file automatically.

3) Forward non-simulated phishing emails to - when the user reports a non-simulated phishing email, a copy of the email including the original headers as an attachment will be forwarded to these email addresses. List the emails here with comma separation.

4) Send us a copy - when the user reports a non-simulated phishing email, a copy of the message including original email headers will be forwarded to us. We can then analyze and even create phishing templates to use in simulated phishing attacks.

5) Forwarded email prefix - when a non-simulated phishing email is forwarded to the recipients you set above, this prefix will be added before the original subject line.

6) Show a message when the user reports a non-simulated phishing email - when enabled, the message will be displayed to the user when they report a non-simulated phishing email. When creating your custom message, be mindful of the maximum character count - Client PAB (469 characters) and Server PAB (500 characters).

7) Paid Only: Show a message when the user reports a phishing security test email - when enabled, the message will be displayed to the user when they report a phishing email that was a simulated phishing email. When creating your custom message, be mindful of the maximum character count - Client PAB (469 characters) and Server PAB (500 characters).

8) Button text - the text that will appear on the Phish Alert button in the user email client.

9) Button group text - the label that will appear under the Phish Alert button in the user email client.

10) Download Outlook add-in installer - the link you use to download the latest version of Phish Alert for Outlook.

11) Download manifest for Exchange 2013, 2016 - this is the manifest file for installation of the add-in for Exchange 2013, 2016.

12) Download manifest for Office 365 (supports mobile) - this is the manifest file for installation of the add-in for Office 365 and the Outlook mobile app (Android and iOS).

13) Download Config file for Chrome Extension - download this file if you're installing the Phish Alert on your organization's Google Apps/GSuite.

Back to top

Multiple PAB instances

You can set up multiple instances of the PAB for your organization to define unique settings (prompt messages, languages, or other) for specific end-users. Adding another PAB instance provides you with an additional license key for your new instance and a new set of editable settings.

Instructions for setting up multiple PAB instances will vary depending on your mail client. To help get you started, review the articles below:

• Setting Up Multiple Phish Alert Button Instances for Your Organization
• Multi-PAB: How to Set Up Multiple PAB Instances in Exchange or Office 365
• Multi-PAB: How to Set Up Multiple PAB Instances in Google Suite

Back to top

PAB reporting

Free Version: The console Dashboard will display a graph tracking how many phishing emails are being reported by your users. You can download a CSV of this data, which will include the date and number of times the PAB was used by your users.

Paid Version: The console Dashboard will display a graph tracking how many phishing emails are being reported by your users, and whether these emails are simulated or non-simulated (potential real phishing attacks). You can download a CSV of this data, which will include the date and number of times the PAB was used by your users, and if the reported emails are simulated or non-simulated.

All individual phishing campaign reports will include a check mark under the Reported column (see below) if a user reports a simulated phishing email from that campaign. This allows Admins to see which users are correctly identifying potential threats and paying attention to their inbox.

You can see which phishing emails a user reported in their user profile area, as well as in the "Users" tab of any phishing campaign in the console.

Example of a user profile showing reported phishing emails: 

Back to top

Data the add-in sends to our servers

The add-in communicates with our API over SSL, which is always securely encrypted. The external IP address, user agent, and other standard browser information are sent to us as part of the standard HTTPS communication.

Information sent from the user's machine to our servers:

• License Key
• Add-in Version
• Operating System
• Operating System Architecture (32 or 64 bit)
• Outlook Version
• Windows configured language (EN, DE, etc.)
• OS ID - random GUID generated for each individual workstation
• User's email address (we don't store it unless it is already in our system)

When the email is not a phishing security test and the user clicks the PAB, the reported email is never sent to us (unless you explicitly allow that in your account settings). Rather, the add-in communicates with our servers to retrieve the email address(es) the reported email needs to be forwarded to. The email is then forwarded to the email address(es) straight from the email client. The process is similar to when a user presses the Forward button.

Back to top

PAB compatibility matrix

Back to top