What it does. Implement a phishing report button (Microsoft 365 built-in Report button Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-phishing-reporting-button-workflow, or copy the skill folder into ~/.claude/skills/building-phishing-reporting-button-workflow/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-phishing-reporting-button-workflow/SKILL.md

SKILL.md (verbatim)

name: building-phishing-reporting-button-workflow
description: Implement a phishing report button (Microsoft 365 built-in Report button
  or third-party like KnowBe4/Cofense) in email clients with a SOAR-driven automated
  triage workflow that classifies reported emails, extracts IOCs, takes remediation
  actions, and gives feedback to reporters. Use when deploying user-reported phishing
  intake or automating triage of the resulting reporting mailbox.
domain: cybersecurity
subdomain: phishing-defense
tags:
- phishing-reporting
- email-security
- incident-response
- security-awareness
- outlook
- microsoft-365
- soar
mitre_attack:
- T1566.001
- T1566.002
- T1598.003
- T1204.001
- T1534
mitre_f3:
  version: '1.1'
  tactics:
  - reconnaissance
  - resource-development
  - initial-access
  - stealth
  techniques:
  - id: T1598
    name: Phishing for Information
    tactic: reconnaissance
    source: attack
  - id: T1660
    name: Phishing
    tactic: initial-access
    source: attack
  - id: T1672
    name: Email Spoofing
    tactic: stealth
    source: attack
  - id: F1020.002
    name: 'Create Fake Materials: Fake Website'
    tactic: resource-development
    source: f3
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.AT-01
- DE.CM-09
- RS.CO-02
- DE.AE-02

Building Phishing Reporting Button Workflow

Overview

A phishing reporting button empowers users to flag suspicious emails directly from their email client, creating a critical feedback loop between end users and the security operations center. Microsoft's built-in Report button is now the recommended approach, replacing the deprecated Report Message and Report Phishing add-ins. When combined with automated triage using SOAR platforms, reported emails can be classified, IOCs extracted, and remediation actions taken within minutes. Organizations with effective phishing reporting programs see 70%+ report rates in phishing simulations.

When to Use

• When deploying or configuring building phishing reporting button workflow capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Microsoft 365 or Google Workspace with administrative access
• SOAR platform or automation capability (Microsoft Sentinel, Splunk SOAR, Cortex XSOAR)
• Dedicated reporting mailbox for phishing submissions
• Email security gateway with message retraction capability
• Security awareness training platform for feedback loop

Workflow

Step 1: Deploy Phishing Report Button

• Enable Microsoft built-in Report button via Security & Compliance Center
• Configure user reported settings: route to reporting mailbox and Microsoft
• For third-party: deploy KnowBe4 Phish Alert Button or Cofense Reporter
• Verify button appears in Outlook desktop, web, and mobile clients
• Configure report options: Report Phishing, Report Junk, Report Not Junk

Step 2: Build Automated Triage Pipeline

• Configure reporting mailbox monitored by SOAR platform
• Auto-extract IOCs from reported emails: URLs, attachments, sender info, headers
• Submit URLs to VirusTotal, URLScan.io for reputation check
• Submit attachments to sandbox for dynamic analysis
• Check sender against known threat intelligence feeds
• Auto-classify: confirmed phishing, spam, simulation, legitimate

Step 3: Implement Response Actions

• Confirmed phishing: auto-retract from all inboxes, block sender domain
• Confirmed spam: move to junk for all recipients
• Simulation email: mark as correctly reported, credit user
• Legitimate email: return to inbox, notify reporter
• Generate IOC report for threat intelligence team

Step 4: Create Feedback Loop

• Send automated thank-you response to reporter within 5 minutes
• Include classification result when analysis completes
• Track reporter accuracy and engagement metrics
• Recognize top reporters in monthly security newsletter
• Feed reporting metrics into security awareness training program

Step 5: Measure and Optimize

• Track mean time to triage (target: under 10 minutes automated)
• Monitor report volume trends and false positive rates
• Measure user reporting rate in phishing simulations
• Report on confirmed threats caught by user reports vs. gateway
• Optimize automation rules based on classification accuracy

Tools & Resources

• Microsoft Report Button: Built-in Outlook phishing reporting
• Cofense Reporter + Triage: Enterprise phishing reporting and automated analysis
• KnowBe4 Phish Alert Button: Integrated reporting with simulation platform
• Microsoft Sentinel: SOAR automation for triage workflow
• Proofpoint CLEAR: Closed-loop email analysis and response

Validation

• Report button visible and functional across all Outlook platforms
• Reported email arrives in dedicated mailbox within 60 seconds
• Automated triage classifies test phishing email correctly
• Auto-retraction removes confirmed phishing from all inboxes
• Reporter receives feedback notification with classification
• Metrics dashboard shows report volume and accuracy trends

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Phishing Reporting Button Workflow Template

Reporting Button Configuration

Triage Automation Rules

Reporting Metrics Dashboard

references/api-reference.md (verbatim)

API Reference: Phishing Reporting Button Workflow

Email Parsing (Python email module)

from email import policy
from email.parser import BytesParser

with open("report.eml", "rb") as f:
    msg = BytesParser(policy=policy.default).parse(f)
headers = {
    "from": msg["From"], "subject": msg["Subject"],
    "reply_to": msg["Reply-To"], "received": msg.get_all("Received")
}

Phishing Indicators

VirusTotal URL Scan

GET https://www.virustotal.com/api/v3/urls/{url_id}
x-apikey: YOUR_KEY

URL ID = base64url(url) or sha256(url)

Dangerous File Extensions

Verdict Classification

Ticketing Integration

POST /api/v2/tickets
Authorization: Bearer TOKEN
{
  "title": "Phishing Report: ...",
  "severity": "high",
  "description": "...",
  "indicators": ["Reply-To mismatch", ...]
}

Microsoft Report Message Add-in

POST https://graph.microsoft.com/v1.0/users/{id}/messages/{msgId}/move
{"destinationId": "phishing-mailbox-id"}

references/standards.md (verbatim)

Standards & References: Building Phishing Reporting Button Workflow

MITRE ATT&CK References

• T1566.001: Phishing: Spearphishing Attachment
• T1566.002: Phishing: Spearphishing Link
• T1204: User Execution
• D3-RERE: User Reporting (MITRE D3FEND)

Industry Standards

• NIST SP 800-61 Rev.2: Computer Security Incident Handling Guide
• CIS Controls v8 Control 14: Security Awareness and Skills Training
• ISO 27001 A.6.3: Information Security Awareness, Education and Training

Reporting Platform Comparison

Key Metrics

• Report Rate: Percentage of phishing simulations reported (target: >70%)
• Mean Time to Triage: Time from report to classification (target: <10 min)
• False Positive Rate: Legitimate emails reported as phishing
• Threat Catch Rate: Real threats first detected by user reports
• Reporter Accuracy: Percentage of reports that are actual threats

references/workflows.md (verbatim)

Workflows: Building Phishing Reporting Button Workflow

Workflow 1: Automated Phishing Report Triage

User clicks "Report Phishing" button
  |
  v
[Email forwarded to reporting mailbox]
  +-- Original email preserved with full headers
  +-- Reporter identity recorded
  |
  v
[SOAR platform ingests report]
  |
  v
[Automated IOC extraction]
  +-- Extract sender address and domain
  +-- Extract all URLs from body
  +-- Extract attachment hashes (MD5, SHA256)
  +-- Parse email headers for authentication results
  |
  v
[Automated analysis (parallel)]
  +-- URLs -> VirusTotal, URLScan.io, PhishTank
  +-- Attachments -> Sandbox detonation
  +-- Sender -> Threat intelligence lookup
  +-- Headers -> SPF/DKIM/DMARC validation
  |
  v
[Classification]
  +-- CONFIRMED PHISHING: High-confidence malicious
  +-- SUSPICIOUS: Moderate indicators, needs analyst review
  +-- SPAM: Unwanted but not malicious
  +-- SIMULATION: Matches internal phishing test
  +-- CLEAN: Legitimate email, false report
  |
  v
[Automated response by classification]
  +-- PHISHING: Retract from all inboxes + block sender
  +-- SUSPICIOUS: Escalate to SOC analyst
  +-- SPAM: Move to junk for all recipients
  +-- SIMULATION: Credit reporter in training platform
  +-- CLEAN: Return to inbox
  |
  v
[Feedback to reporter]
  +-- "Thank you for reporting" (immediate)
  +-- Classification result (when complete)
  +-- Training tip (if false positive)

Workflow 2: SOC Analyst Escalation

SOAR classifies report as SUSPICIOUS
  |
  v
[SOC analyst reviews]
  +-- Examine full email content and headers
  +-- Verify automated analysis results
  +-- Check for similar reports from other users
  |
  v
[Analyst decision]
  +-- Confirm malicious --> Trigger remediation playbook
  +-- Confirm clean --> Close and notify reporter
  +-- Need more info --> Contact reporter for context

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.