This article explains how to automate the routing of emails reported by users through the "Report Phishing" button, with the goal of automatically distinguishing reports related to phishing simulations from those concerning real threats.
The simulation emails that return to Cyber Guru will define what are known as Cyber Defenders.
Step-by-step procedure:
1. Log in to Power Automate Console, select "Create" and then click on "Automated cloud flow":
2. Name the flow, for example, "Cyber Guru Flow" and in the search bar, select “When a new email arrives in a shared mailbox (V2)”:
Note: Simply enter "shared" as a keyword to make the search easier.
3. Enter the created shared mailbox in “Original Mailbox Address”. Click "Show all" to view additional settings:
4. Select "Folder" and choose "Inbox" by clicking on the folder icon:
5. Click the "+" symbol under the box "When a new email arrives in a shared mailbox (V2)":
6. Select "Control" and then "Condition":
7. In the "Condition" section, replace the value "AND" with "OR" and add a new row by clicking on "New item":
8. Click on the first box "Choose a value" and click on the lightning bolt icon:
9. Select "Body" from the menu that appears:
10. In the next box, instead of "is equal to", select "contains":
11. Then enter in the last box "Choose a value" the value CGRE: en2358nfwf348fnw932jdo4fe4rrewffd
12. Repeat the same steps from point 8 to point 11 to enter the value 85.235.135.191 to achieve a result like the following:
13. Click the "+" symbol under "True":
14. In the search bar, select the action "Forward an email (V2)":
Note: Simply enter "forward" as a keyword to make the search easier.
15. In the left section "Forward an email (V2)", click on the Message Id field, click on the lightning bolt symbol, and search for the Message ID:
16. In the "To*" field, enter the recipient address for Cyber Guru, which is defenders@cyberguru.report:
17. Click on "Show all" and in the "Original Mailbox Address" field, enter the address of the specially created shared mailbox:
18. Finally, click on "Save".