Auto-respond to User Reports

Overview

With Sublime's automatic responses to user reports, Microsoft365 and Google Workspace users can automatically interact with and give feedback to reporting end-users:

1. Acknowledge user report
   • After Sublime receives the user report, we'll insert a templated message into the reporting end-user’s mailbox.
   • In order to insert the message, the reporting mailbox must be active.
2. Close the loop with reporter
   • After the message is classified (malicious, spam, graymail, benign, or simulation), we'll insert another templated message into the reporting end-user’s mailbox.
     • Each classification has a corresponding template that's customizable to fit your organization's needs.
   • In order to insert the message, the reporting mailbox must be active.

If you accept unauthenticated user reports, which are reports coming from a mailbox outside of your organization, automatic responses will only be sent to the authenticated user reports that you receive from active mailboxes in your organization. Automatic responses are not available for IMAP users at this time.

Enable automatic responses

Setting up automatic responses is easy:

1. Firstly, ensure you have an Abuse Mailbox configured.
2. Activate the two Core Automations: "Acknowledge user report" and "Close the loop with reporter".
3. Optional: customize the 6 available templates to your organization's specifications.
4. Optional: add a 1-minute delay to all close the loop messages to prevent both messages from landing in rapid succession.

Once you're done with setup, the templates will be inserted into reporting mailboxes without any additional steps from your analysts.

The Automations will show up on your user reported messages when applicable so you can easily identify which messages have already received the acknowledgement and/or the results of the review.

Example use cases

Reduce end-user outreach about reported messages

Turn on automatic responses to reduce outreach inquiring about the status of a user report from end-users. Reduce time that analysts spend answering questions like "Did you get my report?", "I didn't see that message in my mailbox. Was it phishing after all?", and more.

Provide feedback on the quality of user reports

Constructive feedback is always helpful, and user reports are no different!

Give your reporters information on the outcome of their user report so they can better spot similar messages in the future. Reduce the number of benign, spam, and graymail user reports by letting users know when a given report is not malicious.

Alert reporters after successfully identifying phishing simulations

Use Sublime in coordination with your phishing simulation tool to quickly alert users when they successfully report a phishing simulation. Don't wait days or weeks for your phishing simulation to be considered "done" -- let them know immediately with an automatic response.