EMAIL-8006
mediumUser-Reported Phishing Email
Detects a message a mailbox owner flagged as phishing via the client-side "Report Message"/"Report Phishing" button. Every automated control in this catalogue reacts after the fact - this is the one detection source that can fire before an attacker's link is ever clicked, since it comes from the recipient reading the email rather than a log line. Its coverage depends entirely on security-awareness training and how many recipients actually use the button.
Detection logic
Fires as soon as one event matches: `report_source` is "user" AND `verdict` is "phishing".
{
"detection_type": "selection",
"selection": {
"report_source": "user",
"verdict": "phishing"
}
}Log source: category=email_gateway · Event ID(s): user_report
Required log fields
- reporter
- message_id
- sender
- subject
- report_source
Enabling this in your environment
Where: Mail client add-in configuration (Microsoft "Report Message"/"Report Phishing" add-in, Google Workspace "Report phishing", or a third-party button like Cofense/KnowBe4 PhishER) - deploy org-wide via the mail admin console, not opt-in per user.
# Microsoft 365: Deploy the built-in add-in via the Integrated Apps admin center, then route reports to Defender for Office 365 / a shared mailbox your SIEM ingests
A single report on a live campaign should be enough to trigger a retroactive search-and-purge across every other mailbox that received the same sender/subject/link - don't wait for a second report before acting.
Seen in incidents
False positives
- Users over-reporting legitimate marketing/newsletter email as "phishing" out of habit - track a false-report rate per user/team to calibrate how much weight to give a single report