PhishML Workflow
Below is a diagram of the PhishML workflow. During the tagging process, PhishML applies one of the following tags to qualifying messages: PML:THREAT, PML:CLEAN, or PML:SPAM. Using PhishML tags, you can create custom actions to automate the dispositioning and prioritization of messages in your PhishER Inbox.
PhishML Tags and Actions
To learn more about some recommended settings for the PhishML thresholds, visit our PhishER FAQ article.
Listed below are the settings for three actions that we recommend using for your organization to help identify and respond to email threats faster.
This action will help your organization identify and prioritize messages that are potentially malicious and may require further analysis.
-
For Choose how this action should be triggered, we recommend you select the following settings:
- Specify Tags
- HAS ANY PML:THREAT
To add a tag:- Click on Add new tag and type in the desired name of your tag.
- Then, press the Enter or Return key on your keyboard.
- Specify Tags
-
For Choose the action to be taken on matched messages, we recommend you select the following settings:
- Set Status In Review
Set Priority Critical
Set Category Threat
-
For Choose how you would like to report this action, we recommend using one of the following options:
For this option, we recommend that you create a custom email response that will automatically send to the recipients of your choice. Visit our How to Create a Custom Email Template in PhishER article for more information.
If the Send Email option is selected, we suggest the additional settings below:
- (Optional) For Choose whether or not to halt further actions, click on the checkbox to the left of Stop executing further actions. This allows you to review all messages with a PML:THREAT tag before other actions are triggered.
- For Choose QuickActions settings, we recommend keeping the default settings.
- For Choose whether or not to permanently delete matching messages, we recommend keeping the default settings.
For this option, we recommend that you create an additional action that sends an auto response to selected recipients when you run it manually. To do this, complete part one and two listed below.
Part 1: Select the remaining settings for your PML:THREAT (High Priority Messages) action
- For Choose how you would like to report this action, select None.
- (Optional) For Choose whether or not to halt further actions, click on the checkbox to the left of Stop executing further actions. This allows you to review all messages with a PML:THREAT tag before other actions are triggered.
- For Choose QuickActions settings, we recommend keeping the default settings.
- For Choose whether or not to permanently delete matching messages, we recommend keeping the default settings.
Part 2: Create an Auto Response QuickAction
- For Choose how this action should be triggered, we recommend you select Manual Trigger Only. This will prevent the action from running automatically. Instead, you can run it manually by selecting it from the Run Action drop-down menu or the QuickActions bar (see step 5).
- For Choose the action to be taken on matched messages, we recommend keeping the default settings.
- For Choose how you would like to report this action, we recommend you select Send Email. Using the Email Template, create a custom email response. Visit our How to Create a Custom Email Template in PhishER article for more information.
- For Choose whether or not to halt further actions, we recommend keeping the default settings.
- For Choose QuickActions settings, we recommend you click on the checkbox to the left of Include this action in the QuickAction bar. The action will now display in the QuickActions bar of your PhishER Inbox and in the Actions sidebar of the Message Details screen. Visit here for more information about QuickActions.
- For Choose whether or not to permanently delete matching messages, we recommend keeping the default settings.
This action will help your organization identify and prioritize messages that are considered to be safe or non-threatening.
-
For Choose how this action should be triggered, we recommend you select the following settings:
- Specify Tags
- HAS ANY PML:CLEAN
To add a tag:- Click on Add new tag and type in the desired name of your tag.
- Then, press the Enter or Return key on your keyboard.
- Specify Tags
-
For Choose the action to be taken on matched messages, we recommend you select the following settings:
- Set Status Resolved
Set Priority Medium
Set Category Clean
-
For Choose how you would like to report this action, we recommend using one of the following options:
For this option, we recommend that you create a custom email response that will automatically send to the recipients of your choice. Visit our How to Create a Custom Email Template in PhishER article for more information.
If the Send Email option is selected, we suggest the additional settings below:
- (Optional) For Choose whether or not to halt further actions, we recommend you click on the checkbox to the left of Stop executing further actions. This allows you to review all messages with a PML:CLEAN tag before other actions are triggered.
- For Choose QuickActions settings, we recommend keeping the default settings.
- For Choose whether or not to permanently delete matching messages, we recommend keeping the default settings.
For this option, we recommend that you create an additional action that sends an auto response to selected recipients when you run it manually. To do this, complete part one and two listed below.
Part 1: Select the remaining settings for your PML:CLEAN (Medium Priority Messages) action
- For Choose how you would like to report this action, select None.
- (Optional) For Choose whether or not to halt further actions, we recommend you click on the checkbox to the left of Stop executing further actions. This allows you to review all messages with a PML:CLEAN tag before other actions are triggered.
- For Choose QuickActions settings, we recommend keeping the default settings.
- For Choose whether or not to permanently delete matching messages, we recommend keeping the default settings.
Part 2: Create an Auto Response QuickAction
- For Choose how this action should be triggered, we recommend you select Manual Trigger Only. This will prevent the action from running automatically. Instead, you can run it manually by selecting it from the Run Action drop-down menu or the QuickActions bar (see step 5).
- For Choose the action to be taken on matched messages, we recommend keeping the default settings.
- For Choose how you would like to report this action, we recommend you select Send Email. Using the Email Template, create a custom email response. Visit our How to Create a Custom Email Template in PhishER article for more information.
- For Choose whether or not to halt further actions, we recommend keeping the default settings.
- For Choose QuickActions settings, we recommend you click on the checkbox to the left of Include this action in the QuickAction bar. The action will now display in the QuickActions bar of your PhishER Inbox and in the Actions sidebar of the Message Details screen. Visit here for more information about QuickActions.
- For Choose whether or not to permanently delete matching messages, we recommend keeping the default settings.
This action will help your organization identify and prioritize messages that are determined to be unsolicited or unwanted but not likely to be malicious.
-
For Choose how this action should be triggered, we recommend you select the following settings:
- Specify Tags
- HAS ANY PML:SPAM
To add a tag:- Click on Add new tag and type in the desired name of your tag.
- Then, press the Enter or Return key on your keyboard.
- Specify Tags
-
For Choose the action to be taken on matched messages, we recommend you select the following settings:
- Set Status Resolved
Set Priority Low
Set Category Spam
-
For Choose how you would like to report this action, we recommend using one of the following options:
For this option, we recommend that you create a custom email response that will automatically send to the recipients of your choice. Visit our How to Create a Custom Email Template in PhishER article for more information.
If the Send Email option is selected, we suggest the additional settings below:
- (Optional) For Choose whether or not to halt further actions, we recommend you click on the checkbox to the left of Stop executing further actions. This allows you to review all messages with a PML:SPAM tag before other actions are triggered.
- For Choose QuickActions settings, we recommend keeping the default settings.
- For Choose whether or not to permanently delete matching messages, we recommend keeping the default settings.
For this option, we recommend that you create an additional action that sends an auto response to selected recipients when you run it manually. To do this, complete part one and two listed below.
Part 1: Select the remaining settings for your PML:SPAM (Low Priority Messages) action
- For Choose how you would like to report this action, select None.
- (Optional) For Choose whether or not to halt further actions, we recommend you click on the checkbox to the left of Stop executing further actions. This allows you to review all messages with a PML:SPAM tag before other actions are triggered.
- For Choose QuickActions settings, we recommend keeping the default settings.
- For Choose whether or not to permanently delete matching messages, we recommend keeping the default settings.
Part 2: Create an Auto Response QuickAction
- For Choose how this action should be triggered, we recommend you select Manual Trigger Only. This will prevent the action from running automatically. Instead, you can run it manually by selecting it from the Run Action drop-down menu or the QuickActions bar (see step 5).
- For Choose the action to be taken on matched messages, we recommend keeping the default settings.
- For Choose how you would like to report this action, we recommend you select Send Email. Using the Email Template, create a custom email response. Visit our How to Create a Custom Email Template in PhishER article for more information.
- For Choose whether or not to halt further actions, we recommend keeping the default settings.
- For Choose QuickActions settings, we recommend you click on the checkbox to the left of Include this action in the QuickAction bar. The action will now display in the QuickActions bar of your PhishER Inbox and in the Actions sidebar of the Message Details screen. Visit here for more information about QuickActions.
- For Choose whether or not to permanently delete matching messages, we recommend keeping the default settings.
Related Resources:
Comments
0 comments
Article is closed for comments.