I know you have the ability to create multiple reporting email addresses for messages to go into PhishER, but I'm having trouble getting it to be useful. The documentation states that it can be useful for giving different organizational units or locations different addresses. There doesn't appear to be anything you can do with that information after the messages have been received.
Is there some way to create rules around which PhishER mailbox received the message? The YARA rules all act on the contents of the messages and there doesn't appear to be anywhere that the PhishER address appears. I would expect there to be some way to say "run this rule or add this tag if message was submitted to [abcd]@phisher.knowbe4.com" or "don't run this rule if it was submitted to [xyz]@phisher.knowbe4.com"
Kirjaudu sisään jättääksesi kommentin.