Email reporting | TrendAI™

Views:

Control whether users can report emails as false positives or false negatives to TrendAI™ or specified administrators.

These settings apply to the email reporting function in the Add-in for Outlook and the warning banner in Correlated Intelligence of Advanced Threat Protection policies.

Note

If you deployed the add-in before March 22, 2024, deploy it again from the Microsoft 365 admin center so your users can report emails to administrators in your organization.

When email reporting is turned on, Cloud App Security activates the reporting actions in the warning banner at the top of the email body. This applies to anomalous emails detected by predefined correlation rules in Correlated Intelligence.

Procedure

Turn on Report to TrendAI™ to allow your users to report emails as spam, phishing, or not a risk to TrendAI™ .

Note

Enabling this option allows TrendAI™ to collect your email metadata for further analysis and investigation.

Reporting an email also sends a copy of the email to TrendAI™ . However, this action does not move or delete the email.

Select whether to exclude emails that match the approved header field list (configured under Policies → Global Settings → User-Defined Lists → Approved/Blocked Lists) from being reported to TrendAI™ for analysis.

To get visibility into the emails skipped from reporting, go to Operations → User-Reported Emails. For details, see User-reported emails.
Select whether to require manual approval for reported emails before sending them to TrendAI™ .

After you enable this option, the system does not send reports from users to TrendAI™ until you manually approve them.

If you disable reporting approval, the system automatically approves reports that are waiting for approval.

To get visibility into or manually approve the emails reported by your users, go to Operations → User-Reported Emails. For details, refer to User-reported emails.

Turn on Report to administrators so users can report emails to your organization's administrator mailboxes for analysis and investigation.

Specify one to 10 email addresses to receive reported emails.

Note

To prevent reported emails from being scanned and deleted or blocked by Cloud App Security, enter email addresses in the current organization.

Select whether to send reporters a confirmation email when they report an email through the add-in or email banner.

Note

This option is available only when Report to TrendAI™ or Report to administrators is enabled.
Select whether to use the preconfigured TrendAI™ email content or your own content for confirmation emails to reporters.

You can customize the subject and body of the confirmation email.

Note

You can include relevant tokens and edit the message content as desired. For details about tokens, see Token list.
To remove reported spam or phishing emails from users' inboxes, select When reported as spam or phishing, move the message to the Junk folder.