Google Workspace - Forward Phish Reports From Internal Security Mailbox

Does your organization use a security mailbox that users forward suspected phishing material to? If so, this support article is for you! In this article, we'll walkthrough the process of integrating CanIPhish with your security mailbox, so suspected phishing material is seamlessly forwarded to CanIPhish, allowing you to view the emails in our platform, and importantly, automatically categorize simulated phishing email reports.

Table of Contents

• Prerequisite: Get Your Unique CanIPhish Reporting Mailbox
• Creating A Security Mailbox In Google Workspace

Prerequisite: Get Your Unique CanIPhish Reporting Mailbox

a. Locate your dedicated tenant-specific CanIPhish mailbox. This mailbox can be found by going to Reporting > Reported Emails > Advanced Settings:

b. Your dedicated tenant-specific CanIPhish mailbox is located in the Forwarding Inbox field:

c. If you haven't already, make sure your Email Reporting Status is set to Enabled.

Creating A Security Mailbox In Google Workspace

Note: If you already have a security mailbox, please read through this step anyway to ensure it is configured in-line with what's outlined below.

1. Go to Directory > Groups and then click Create group:

2. Create the Group with the following information and then click NEXT:

• Group name: A name of your choosing (e.g. Phish Report Mailbox)
• Group email: An email of your choosing. This is the email address that users will be forwarding suspected phishing material to. Ideally, make this something memorable (e.g. phishing@yourdomain.com)
• Group description: A description of your choosing
• Group owners: Leave this blank (unless you want emails forwarded to this mailbox, to also get forwarded to another mailbox that's not associated with CanIPhish)

3. Configure the access settings in line with the screenshot below, notably ensuring "Allow members outside your organization" is toggled on. Once configured, click CREATE GROUP:

4. Click Add members to Phish Report Mailbox:

5. Click Add members:

6. Enter your unique CanIPhish Reporting Mailbox that was noted as part of the prerequisite activity. Please note that once entered, you may need to wait 5-10 seconds for it to then appear in the dropdown where you can then select it:

7. Click ADD TO GROUP.

You're all done! From now on, whenever a user forwards an email to your internal Phish Report Mailbox (e.g. phishing@yourdomain.com), the email will be seamlessly forwarded to your unique CanIPhish Reporting Mailbox. Emails sent to this mailbox are automatically analyzed and visible in the Reported Phishing dashboard. Additionally, simulated phishing emails will be automatically attributed and marked as such in campaigns.

If you run into any issues, please feel free to contact the CanIPhish Support Team.