If your organization uses the Proofpoint PhishAlarm button to report suspicious emails, you can configure PhishAlarm to recognize Right-Hand Cybersecurity phishing simulation emails and forward them to PhishArm when your users report them.
With this configuration in place:
Right-Hand Cybersecurity phishing simulation emails are identified by their custom header and kept separate from genuine suspicious emails.
Reported phishing simulation emails are forwarded automatically to [email protected], so the report is recorded in Right-Hand Cybersecurity.
Genuine suspicious emails that your users report continue through your existing security or SOC workflow.
Before You Begin
Make sure you have the following in place:
Allowlisting: Allowlist the Right-Hand Cybersecurity IP addresses and domains in Proofpoint, so phishing simulation emails are delivered to your users. For the full list of IP addresses and domains, see Whitelisting Best Practices.
Custom header details: Have your organization’s Right-Hand Cybersecurity custom Header Name and Header Value ready. If you don’t have them, contact your CSM or the Support Team at Right-Hand Cybersecurity via [email protected].
Admin access: Make sure you can sign in to the Proofpoint Security Education Platform with permission to change PhishAlarm settings.
Step 1: Create a PhishAlarm Safelist Rule
Create a safelist rule that identifies Right-Hand Cybersecurity phishing simulation emails by their custom header.
1.1 Sign in to the Proofpoint Security Education Platform.
1.2 Go to PhishAlarm > Settings, and then select the Safelist tab.
1.3 Under Configure a New Safelist Rule, enter a name in the Name field, for example, Right-Hand Cybersecurity Phishing Simulations.
1.4 Set Condition to Header.
1.5 Enter your Right-Hand Cybersecurity custom header details:
Next to Value for name, set Criteria to Starts with, and then enter your header name.
Next to Value for key, set Criteria to Contains, and then enter your header value.
1.6 Select the Allow end-users to report emails matching this rule checkbox.
1.7 Click Create Safelist.
Note: Proofpoint header matching is case-sensitive. Enter the header name and value exactly as Right-Hand Cybersecurity provided them. Both the name and the value must match for the rule to apply.
Step 2: Forward Safelisted Reports to PhishArm
Configure PhishAlarm to forward reported emails that match your safelist rules to PhishArm.
Important: Safelist email forwarding applies to all safelist rules, not just the one you created in Step 1. If you already have other safelist rules, confirm that forwarding their reports to PhishArm won’t disrupt how you handle them.
2.1 Go to PhishAlarm > Settings > Admin Communications.
2.2 In the Reported Email Handling section, find Safelist email handling.
2.3 Set Safelist email handling to Forward to the following email addresses.
2.4 Enter [email protected].
2.5 Click Save Changes.
Note: Don’t change the Potential phishing email handling settings. Leaving them as they are ensures genuine suspicious emails continue to reach your SOC or abuse mailbox.
Step 3: Test the Configuration
3.1 Send a Right-Hand Cybersecurity phishing simulation email to a test user.
3.2 Have the test user close and reopen their email client and report the email using the PhishAlarm button.
3.3 Confirm that the report appears on the PhishArm dashboard in Right-Hand Cybersecurity.
If the report doesn’t appear, check that the header name and value in your safelist rule exactly match the details Right-Hand Cybersecurity provided, and that Safelist email handling is set to forward to [email protected].