User-reported phishing workflow
Overview
Reporting add-ins turn users into sensors—reward good reports, close loop fast.
Flow
User reports → SOAR triage bucket → auto-duplicate search other inboxes → analyst verdict → user thank-you microcopy.
SLA
8 business hours initial triage for regulated clients; faster for VIP mailboxes.
Metrics
Report rate per 1000 mailboxes; false positive ratio target.
Anti-pattern
Ignoring reports—users stop participating.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...