How to Use Proofpoint PhishAlarm with Keepnet
A short, customer-facing guide that explains why you should connect Proofpoint’s PhishAlarm to Keepnet, the benefits you’ll get, and clear step-by-step setup instructions so simulated phishing reports land in Keepnet automatically.
Why connect Proofpoint PhishAlarm to Keepnet?
Connecting Proofpoint’s PhishAlarm button to Keepnet gives you a single, accurate place to track all reported emails, including simulated phishing, so you can measure human risk, run campaigns, and take automated remediation actions.
Key benefits:
Accurate campaign measurement — Simulated phishing reports show up in your Keepnet phishing campaign stats (reporters, reporter rate, phishing dwell time).
Cleaner metrics (no noise) — Keepnet’s Incident Responder and reporting pipeline distinguishes real threats from simulation telemetry and bots, so your human risk scores are reliable.
Faster remediation — When an email (real or simulated) is reported, Keepnet can trigger automated scanning, inbox sweep/removal, and incident workflows.
Better behaviour insights — Reports feed into human risk scoring, leaderboards, repeat-offender lists and targeted learning paths.
Single-pane visibility — All reported emails (simulated + real) are visible alongside campaign context, so security and HR can make data-driven decisions.
High-level flow
Employee clicks Proofpoint PhishAlarm to report an email.
Proofpoint forwards that reported email to your unique Keepnet inbound address (in [email protected] format).
Keepnet ingests the report, links it to the correct phishing campaign (if it was part of a simulation), and updates Human Risk Score, campaign metrics, and dashboards.
(Optional) Keepnet Incident Responder runs automated analysis and remediation.
What you need
Proofpoint PhishAlarm is enabled for users in your org.
Your unique Keepnet inbound address (format): [email protected] — use the exact address provided by Keepnet.
Admin access in Proofpoint (or someone who can add/modify the PhishAlarm forwarding address).
Step-by-step setup in Proofpoint
These are concise, generic steps — your Proofpoint UI layout/version may look a little different. If you need screenshots, we can add them.
Login to Proofpoint Admin Console.
Open the PhishAlarm or Report Button configuration (often under End User Tools / PhishAlarm settings).
Configure the forward / destination address for reported items:
Set the report/forward recipient to your Keepnet inbound address: [email protected]
If Proofpoint requires a display name, use something simple like: Keepnet Report Ingest
Save and deploy the configuration so it applies to your user groups.
Test the flow (see next section).
If Proofpoint allows per-group settings, apply the forwarding to the groups you’re piloting first (e.g., 50–200 users) before rolling out org-wide.
Testing & verification (quick test)
From an internal test account, send a simulated phishing email to a test user (or use an existing Keepnet simulation).
Ask the test user to click the Proofpoint PhishAlarm button on that email.
In Keepnet: go to Phishing Campaigns → [Your Campaign] → Reported (or Inbox > Reported Emails depending on your UI).
You should see the reported item appear within 1–2 minutes, with fields such as: Reporter, Report Time, Subject, Original Sender, Attachment indicator, and Campaign tag (if it was part of a simulation).
Example of how a reported simulated phishing email will display in Keepnet
(Your Keepnet UI may look different — this is a representative example.)
Reporter
Report Time
2025-10-27 09:12:03 (Europe/London)
Subject
Urgent: Password Expiry Notice
Original Sender
Campaign
Q4 Security Awareness — Payroll Phish
Report Type
Simulated (auto-linked to campaign)
Action Taken
Scanned by Incident Responder; quarantined in 12 inboxes
Human Risk Impact
+0.6 on Reporter Score (improved)
What Keepnet will do after receiving a report
Auto-link the report to the phishing campaign (if the message ID or campaign headers match).
Update human risk & campaign metrics (reporter rates, dwell time, repeat offenders).
Run Incident Responder integrations (sandbox analysis, sandbox verdicts, remove/quarantine) if configured.
Present the report in dashboards, leaderboards, and executive reports.
Common troubleshooting
Reports not showing in Keepnet
Check the forwarding address in Proofpoint — ensure it’s exactly [email protected] with no typos.
Confirm Proofpoint logs show successful delivery to that address.
In Keepnet, check ingestion logs for the inbound address (or ask Keepnet Support to check ingestion queue).
Reports arrive but not linked to campaign
Ensure simulations include the campaign headers or Message-ID mapping that Keepnet uses to auto-link. If not, Keepnet can link by subject + timestamp but header linkage is more reliable.
Delayed reports
Check email routing / proofpoint processing delays and Keepnet ingestion queue. Network retries could cause short delays.
Duplicate reports
If multiple report buttons or auto-forward rules exist, deduplication settings in Keepnet can be enabled — ask your Keepnet admin.
FAQs
Q: Can I use one inbound address for multiple companies?
A: No — use the exact Keepnet address assigned to your company (the companyID is unique). This ensures reports are routed to the correct tenant in Keepnet.
Q: Will Keepnet distinguish simulated vs real phishing?
A: Yes — Keepnet links reported items to campaigns and flags simulation reports. Analysis and remediation policies can be different for simulations vs confirmed threats.
Q: How quickly will reports update my human risk score?
A: Reports typically update dashboards and scores within minutes after ingestion and analysis.
Next steps & support
Provide the Keepnet inbound address to your Proofpoint admin and apply the forwarding rule.
Run a small pilot (50–200 users) and verify reports appear in Keepnet and link to campaigns.
If you want, Keepnet can validate header mapping so simulated campaign emails are always auto-linked.
For help troubleshooting Proofpoint or Keepnet ingestion logs, contact: [email protected] or your Keepnet Customer Success Manager.
Last updated