Menu

How to Use PhishML Tags

Avatar
Natalie Koly
Updated
Follow

PhishML Workflow

Below is a diagram of the PhishML workflow. During the tagging process, PhishML applies one of the following tags to qualifying messages: PML:THREAT, PML:CLEAN, or PML:SPAM. Using PhishML tags, you can create custom actions to automate the dispositioning and prioritization of messages in your PhishER Inbox.

 

PhishML Tags and Actions

To learn more about some recommended settings for the PhishML thresholds, visit our PhishER FAQ article.

Listed below are the settings for three actions that we recommend using for your organization to help identify and respond to email threats faster.

PML:THREAT (High Priority Messages)

This action will help your organization identify and prioritize messages that are potentially malicious and may require further analysis.

  1. For Choose how this action should be triggered, select the following settings:

    • Specify Tags
      • HAS ANY PML:THREAT
    To add a tag:
    1. Click on Add new tag and type in the desired name of your tag.
    2. Then, press the Enter or Return key on your keyboard.

  2. For Choose the action to be taken on matched messages, select the following settings:

    • Set Status In Review

    • Set Priority Critical

    • Set Category Threat

  3. For Choose how you would like to report this action, we recommend using one of the following options:

    For this option, we recommend that you create a custom email response that will automatically send to the recipients of your choice. Visit our How to Create a Custom Email Template in PhishER article for more information.

    If the Send Email option is selected, we suggest the additional settings below:

    1. (Optional) For Choose whether or not to halt further actions, click on the checkbox to the left of Stop executing further actions. This allows you to review all messages with a PML:THREAT tag before other actions are triggered.
    2. For Choose QuickActions settings, we recommend keeping the default settings.
    3. For Choose whether or not to permanently delete matching messages, we recommend keeping the default settings.

    For this option, we recommend that you create an additional action that sends an auto response to selected recipients when you run it manually. To do this, complete part one and two listed below.

    Part 1: Select the remaining settings for your PML:THREAT (High Priority Messages) action

    1. For Choose how you would like to report this action, select None.
    2. (Optional) For Choose whether or not to halt further actions, click on the checkbox to the left of Stop executing further actions. This allows you to review all messages with a PML:THREAT tag before other actions are triggered.
    3. For Choose QuickActions settings, we recommend keeping the default settings.
    4. For Choose whether or not to permanently delete matching messages, we recommend keeping the default settings.

    Part 2: Create an Auto Response QuickAction

    1. For Choose how this action should be triggered, select Manual Trigger Only. This will prevent the action from running automatically. Instead, you can run it manually by selecting it from the Run Action drop-down menu or the QuickActions bar (see step 5). 
    2. For Choose the action to be taken on matched messages, we recommend keeping the default settings.
    3. For Choose how you would like to report this action, select Send Email. Using the Email Template, create a custom email response. Visit our How to Create a Custom Email Template in PhishER article for more information.

    1. For Choose whether or not to halt further actions, we recommend keeping the default settings.
    2. For Choose QuickActions settings, click on the checkbox to the left of Include this action in the QuickAction bar. The action will now display in the QuickActions bar of your PhishER Inbox and in the Actions sidebar of the Message Details screen. Visit here for more information about QuickActions.
    3. For Choose whether or not to permanently delete matching messages, we recommend keeping the default settings.
PML:CLEAN (Medium Priority Messages)

This action will help your organization identify and prioritize messages that are considered to be safe or non-threatening.

  1. For Choose how this action should be triggered, select the following settings:

    • Specify Tags
      • HAS ANY PML:CLEAN
    To add a tag:
    1. Click on Add new tag and type in the desired name of your tag.
    2. Then, press the Enter or Return key on your keyboard.

  2. For Choose the action to be taken on matched messages, select the following settings:

    • Set Status Resolved

    • Set Priority Medium

    • Set Category Clean

  3. For Choose how you would like to report this action, we recommend using one of the following options:

    For this option, we recommend that you create a custom email response that will automatically send to the recipients of your choice. Visit our How to Create a Custom Email Template in PhishER article for more information.

    If the Send Email option is selected, we suggest the additional settings below:

    1. (Optional) For Choose whether or not to halt further actions, click on the checkbox to the left of Stop executing further actions. This allows you to review all messages with a PML:CLEAN tag before other actions are triggered.
    2. For Choose QuickActions settings, we recommend keeping the default settings.
    3. For Choose whether or not to permanently delete matching messages, we recommend keeping the default settings.

    For this option, we recommend that you create an additional action that sends an auto response to selected recipients when you run it manually. To do this, complete part one and two listed below.

    Part 1: Select the remaining settings for your PML:CLEAN (Medium Priority Messages) action

    1. For Choose how you would like to report this action, select None.
    2. (Optional) For Choose whether or not to halt further actions, click on the checkbox to the left of Stop executing further actions. This allows you to review all messages with a PML:CLEAN tag before other actions are triggered.
    3. For Choose QuickActions settings, we recommend keeping the default settings.
    4. For Choose whether or not to permanently delete matching messages, we recommend keeping the default settings.

    Part 2: Create an Auto Response QuickAction

    1. For Choose how this action should be triggered, select Manual Trigger Only. This will prevent the action from running automatically. Instead, you can run it manually by selecting it from the Run Action drop-down menu or the QuickActions bar (see step 5). 
    2. For Choose the action to be taken on matched messages, we recommend keeping the default settings.
    3. For Choose how you would like to report this action, select Send Email. Using the Email Template, create a custom email response. Visit our How to Create a Custom Email Template in PhishER article for more information.

    1. For Choose whether or not to halt further actions, we recommend keeping the default settings.
    2. For Choose QuickActions settings, click on the checkbox to the left of Include this action in the QuickAction bar. The action will now display in the QuickActions bar of your PhishER Inbox and in the Actions sidebar of the Message Details screen. Visit here for more information about QuickActions.
    3. For Choose whether or not to permanently delete matching messages, we recommend keeping the default settings.
PML:SPAM (Low Priority Messages)

This action will help your organization identify and prioritize messages that are determined to be unsolicited or unwanted but not likely to be malicious.

  1. For Choose how this action should be triggered, select the following settings:

    • Specify Tags
      • HAS ANY PML:SPAM
    To add a tag:
    1. Click on Add new tag and type in the desired name of your tag.
    2. Then, press the Enter or Return key on your keyboard.

  2. For Choose the action to be taken on matched messages, select the following settings:

    • Set Status Resolved

    • Set Priority Low

    • Set Category Spam

  3. For Choose how you would like to report this action, we recommend using one of the following options:

    For this option, we recommend that you create a custom email response that will automatically send to the recipients of your choice. Visit our How to Create a Custom Email Template in PhishER article for more information.

    If the Send Email option is selected, we suggest the additional settings below:

    1. (Optional) For Choose whether or not to halt further actions, click on the checkbox to the left of Stop executing further actions. This allows you to review all messages with a PML:SPAM tag before other actions are triggered.
    2. For Choose QuickActions settings, we recommend keeping the default settings.
    3. For Choose whether or not to permanently delete matching messages, we recommend keeping the default settings.

    For this option, we recommend that you create an additional action that sends an auto response to selected recipients when you run it manually. To do this, complete part one and two listed below.

    Part 1: Select the remaining settings for your PML:SPAM (Low Priority Messages) action

    1. For Choose how you would like to report this action, select None.
    2. (Optional) For Choose whether or not to halt further actions, click on the checkbox to the left of Stop executing further actions. This allows you to review all messages with a PML:SPAM tag before other actions are triggered.
    3. For Choose QuickActions settings, we recommend keeping the default settings.
    4. For Choose whether or not to permanently delete matching messages, we recommend keeping the default settings.

    Part 2: Create an Auto Response QuickAction

    1. For Choose how this action should be triggered, select Manual Trigger Only. This will prevent the action from running automatically. Instead, you can run it manually by selecting it from the Run Action drop-down menu or the QuickActions bar (see step 5). 
    2. For Choose the action to be taken on matched messages, we recommend keeping the default settings.
    3. For Choose how you would like to report this action, select Send Email. Using the Email Template, create a custom email response. Visit our How to Create a Custom Email Template in PhishER article for more information.

    1. For Choose whether or not to halt further actions, we recommend keeping the default settings.
    2. For Choose QuickActions settings, click on the checkbox to the left of Include this action in the QuickAction bar. The action will now display in the QuickActions bar of your PhishER Inbox and in the Actions sidebar of the Message Details screen. Visit here for more information about QuickActions.
    3. For Choose whether or not to permanently delete matching messages, we recommend keeping the default settings.

Related Resources:

Back to top

Have more questions? Submit a request

Comments

0 comments

Article is closed for comments.

Related articles