building-phishing-reporting-button-workflow

name	building-phishing-reporting-button-workflow
description	Use when implementing a phishing report button in email clients with automated triage workflow that analyzes user-reported suspicious emails and provides feedback to reporters.
domain	cybersecurity
subdomain	phishing-defense
tags	["phishing-reporting","email-security","incident-response","security-awareness","outlook","microsoft-365","soar"]
mitre_attack	["T1566","T1204","T1534"]
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"]

Building Phishing Reporting Button Workflow

Overview

A phishing reporting button empowers users to flag suspicious emails directly from their email client, creating a critical feedback loop between end users and the security operations center. Microsoft's built-in Report button is now the recommended approach, replacing the deprecated Report Message and Report Phishing add-ins. When combined with automated triage using SOAR platforms, reported emails can be classified, IOCs extracted, and remediation actions taken within minutes. Organizations with effective phishing reporting programs see 70%+ report rates in phishing simulations.

When to Use

Trigger phrases:

• "building phishing reporting button workflow"

• "Implement a phishing report button in email clients with automated triage workfl"

• When deploying or configuring building phishing reporting button workflow capabilities in your environment

• When establishing security controls aligned to compliance requirements

• When building or improving security architecture for this domain

• When conducting security assessments that require this implementation

Prerequisites

• Microsoft 365 or Google Workspace with administrative access
• SOAR platform or automation capability (Microsoft Sentinel, Splunk SOAR, Cortex XSOAR)
• Dedicated reporting mailbox for phishing submissions
• Email security gateway with message retraction capability
• Security awareness training platform for feedback loop

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}