Forward phishing emails from KnowBe4

Configure the KnowBe4 Phish Alert Button to forward user-reported phishing emails to Radiant Security on Microsoft 365 or via the Chrome extension.

In this article, you configure the KnowBe4 Phish Alert Button (PAB) to forward user-reported phishing emails to Radiant Security. PAB configuration is the same regardless of how you deploy it. After you set the forwarding address in KnowBe4, you complete the deployment-specific steps for your environment.

Prerequisites

Before you configure KnowBe4 forwarding, confirm the following:

• Admin access to KnowBe4

• You have completed the steps in the phishing email forwarding overview, including enabling your monitored domains.

• The KnowBe4 Phish Alert Button is already deployed to your users on either Microsoft 365 or Chrome. If you have not deployed PAB yet, follow KnowBe4's documentation before continuing.

Configure the Phish Alert Button

In this step, you set the Radiant Security mailbox as the forwarding destination for non-simulated phishing reports. This configuration applies to every PAB deployment in your KnowBe4 account.

1

Open the Phish Alert settings

In KnowBe4, go to Account Integrations > Phish Alert.

2

Add the Radiant Security mailbox

Edit the PAB configuration for Send Non-Simulated Emails to and add the Radiant Security address:

[email protected]

3

Save your changes

Click Save Phish Alert Settings.

Note: New PAB configuration takes time to propagate across your users' inboxes.

Apply deployment-specific configuration

PAB configuration in KnowBe4 is the same for every deployment, but the Chrome extension requires an additional configuration file. Choose the tab that matches your deployment.

Microsoft 365

No additional configuration is required. Your changes to Send Non-Simulated Emails to propagate automatically to users with the Microsoft 365 add-in installed.

Chrome extension

Verify the integration

After you complete the deployment, confirm reports are reaching Radiant:

1. Send a test message to a mailbox in your organization.

2. Use the Phish Alert Button to report the test message as phishing.

3. Sign in to Radiant Security and check the Alerts and Cases tabs for the triaged report.

If the report does not appear, confirm the following:

• The forwarding address in Send Non-Simulated Emails to is exactly [email protected].

• The user who reported the test message has the latest PAB configuration (KnowBe4 propagation may take time).

• The reporter's domain is enabled in Radiant's Monitored Domains tab.