If your organization uses the Proofpoint PhishAlarm button to report suspicious emails, you can configure PhishAlarm to recognize Right-Hand Cybersecurity phishing simulation emails and forward user reports of them to PhishArm.
With this configuration in place:
Right-Hand Cybersecurity phishing simulation emails are identified by their custom header and kept separate from genuine suspicious emails.
Reported phishing simulation emails are forwarded automatically to [email protected], so the report is recorded in Right-Hand Cybersecurity's platform.
Genuine suspicious emails that your users report continue through your existing security or SOC workflow.
Before You Begin
Make sure you have the following in place:
Allowlisting: Allowlist the Right-Hand Cybersecurity IP addresses and domains in Proofpoint, so phishing simulation emails are delivered to your users. For the full list of IP addresses and domains, see Whitelisting Best Practices.
Custom header details: Have your organization’s Right-Hand Cybersecurity custom header name and header value ready. If you don’t have them, contact your CSM or the Support Team at Right-Hand Cybersecurity via [email protected]
Admin access: Make sure you can sign in to the Proofpoint Security Education Platform with permission to change PhishAlarm settings.
PhishAlarm version: Safelist rules require PhishAlarm v3.1.15 or later.
Step 1: Create a PhishAlarm Safelist Rule
Create a safelist rule that identifies Right-Hand Cybersecurity phishing simulation emails by their custom header.
1.1 Sign in to the Proofpoint Security Education Platform.
1.2 Go to PhishAlarm > Settings, and then select the Safelist tab.
1.3 Under Configure a New Safelist Rule, enter a name in the Name field, for example, Right-Hand Cybersecurity Phishing Simulations.
1.4 Set Condition to Header.
1.5 Enter your Right-Hand Cybersecurity custom header details:
Next to Value for name, set Criteria to Starts with, and then enter your header name.
Next to Value for key, set Criteria to Contains, and then enter your header value.
“Value for key” is where Proofpoint asks for the header value.
Note: Proofpoint header matching is case-sensitive. Enter the header name and value exactly as Right-Hand Cybersecurity provided them. Both the name and the value must match for the rule to apply.
1.6 Select the Allow end-users to report emails matching this rule checkbox.
Note: If this checkbox isn’t selected, reported simulation emails won’t be forwarded to PhishArm.
1.7 Click Create Safelist.
Important Note: Safelist changes take effect only after a user closes and reopens their email client. Plan your rollout so users restart Outlook before your next simulation.
Step 2: Forward Safelisted Reports to PhishArm
Configure PhishAlarm to forward reported emails that match your safelist rules to PhishArm.
Important: Safelist email forwarding applies to all safelist rules, not just the one you created in Step 1. If you already have other safelist rules, confirm that forwarding their reports to PhishArm won’t disrupt how you handle them.
2.1 Go to PhishAlarm > Settings > Admin Communications.
2.2 In the Reported Email Handling section, find Safelist email handling.
Note: Don’t change the Potential phishing email handling settings. Leaving them as they are ensures genuine suspicious emails continue to reach your SOC or abuse mailbox.
2.3 Set Safelist email handling to Forward to the following email addresses.
2.4 In the email address field, enter [email protected].
2.5 Click Save Changes.
Step 3: Test the Configuration
3.1 Send a Right-Hand Cybersecurity phishing simulation email to a test user.
3.2 Have the test user close and reopen their email client and report the email using the PhishAlarm button.
3.3 Confirm that the report appears on the PhishArm dashboard in Right-Hand Cybersecurity's platform.
If the report doesn’t appear, please check the following items:
The header name and value match exactly, including case.
Allow end-users to report emails matching this rule is selected.
The test user restarted their email client after the rule was created.
PhishAlarm is v3.1.15 or later.
Safelist email handling forwards to [email protected].
If the report went to your SOC mailbox instead, the safelist rule didn’t match the email.