KnowBe4 PhishER Extension - PhishRIP
Date: 08/09/2022
Author: Andrew Weston
Introduction
PhishRIP was released in 2020, and is available to all PhishER customers at no extra charge. PhishRIP is a PhishER email quarantine feature that allows your organisation to search for user-reported emails across all of the mailboxes tied to your Microsoft 365 or Google Workspace instances.
I have been looking at the benefits of PhishER for my organisation – what’s the additional benefit of PhishRIP?
When your users use the Phish Alert Button to send suspicious emails to PhishER they are categorised as Clean, Spam or Threat based upon your configuration settings. At this point PhishRIP will take over and search and optionally quarantine similar messages across all your user’s mailboxes. Any messages identified are then ready for further analysis, quarantine or permanent deletion by your incident response team.
What actions can I configure within PhishRIP?
Basically, PhishRIP gives you much more control over how you handle messages. You can customise your search to find messages by key items including sender, attachment or subject. You can quickly and easily search, find and remove messages across all folders and find out whether messages have been read or not. PhishRIP also gives you the ability to automatically quarantine or simply report the result of your query. Specifically, PhishRIP allows you to:
- Remove: Once PhishER has identified a threat, you have the option to remove the same or similar messages from all mail folders, including inbox, sent, or trash folders.
- Inoculate: Because it is likely that you will have users that receive the same email threats and don’t report it, PhishRIP helps you monitor and detect those un-reported email threats so you can report, quarantine and analyse.
- Protect: Once any immediate threats are handled, you now have time to analyse threat details for continued protection in the future. With PhishRIP, you can send messages to your affected users, delete messages from your users’ mailboxes, keep them quarantined, or restore messages that are identified as legitimate.
Can you run me through the PhishER and PhishRIP workflow?
Below is a diagram showing the PhishER workflow. The PhishER platform can help you identify potential email threats through the automated process of rules, tags and actions. If an email threat is identified, PhishRIP provides you with the option to remove the threat from all your users’ inboxes.
Get Notified for New Blogs:
We post regularly on the platforms below, notifying our audience when we publish new pieces.
