# Forward phishing emails from KnowBe4

In this article, you configure the KnowBe4 Phish Alert Button (PAB) to forward user-reported phishing emails to Radiant Security. PAB configuration is the same regardless of how you deploy it. After you set the forwarding address in KnowBe4, you complete the deployment-specific steps for your environment.

### Prerequisites

Before you configure KnowBe4 forwarding, confirm the following:

* [ ] Admin access to KnowBe4
* [ ] You have completed the steps in the [phishing email forwarding overview](/radiant-connectors/connectors-and-data-ingestion/phishing-email-forwarding-overview.md), including enabling your monitored domains.
* [ ] The KnowBe4 Phish Alert Button is already deployed to your users on either Microsoft 365 or Chrome. If you have not deployed PAB yet, follow [KnowBe4's documentation](https://support.knowbe4.com/hc/en-us/articles/208969608-Phish-Alert-Button-PAB-Product-Manual#iv_01H8CHZ6DE0JZC4DB92E8X7X2N) before continuing.

### Configure the Phish Alert Button

In this step, you set the Radiant Security mailbox as the forwarding destination for non-simulated phishing reports. This configuration applies to every PAB deployment in your KnowBe4 account.

{% stepper %}
{% step %}

#### Open the Phish Alert settings

In KnowBe4, go to **Account Integrations > Phish Alert**.
{% endstep %}

{% step %}

#### Add the Radiant Security mailbox

Edit the PAB configuration for **Send Non-Simulated Emails to** and add the Radiant Security address:

`alerts@report.radiantsecurity.ai`
{% endstep %}

{% step %}

#### Save your changes

Click **Save Phish Alert Settings**.

{% hint style="info" %}
**Note:** New PAB configuration takes time to propagate across your users' inboxes.
{% endhint %}
{% endstep %}
{% endstepper %}

### Apply deployment-specific configuration

PAB configuration in KnowBe4 is the same for every deployment, but the Chrome extension requires an additional configuration file. Choose the tab that matches your deployment.

{% tabs %}
{% tab title="Microsoft 365" %}
No additional configuration is required. Your changes to **Send Non-Simulated Emails to** propagate automatically to users with the Microsoft 365 add-in installed.
{% endtab %}

{% tab title="Chrome extension" %}
The Chrome extension requires a configuration file generated by KnowBe4 to apply the new forwarding address.

{% stepper %}
{% step %}
**Download the Chrome extension config file**

In the Phish Alert settings, download the **Chrome Extension PAB config file** (`phish_alert_configuration.json`).
{% endstep %}

{% step %}
**Distribute the config file to your users**

Follow KnowBe4's documentation to deploy the updated config file: [Google Workspace Phish Alert Button (PAB) Product Manual](https://support.knowbe4.com/hc/en-us/articles/115004304108).
{% endstep %}
{% endstepper %}
{% endtab %}
{% endtabs %}

### Verify the integration

After you complete the deployment, confirm reports are reaching Radiant:

1. Send a test message to a mailbox in your organization.
2. Use the Phish Alert Button to report the test message as phishing.
3. Sign in to [Radiant Security](https://app.radiantsecurity.ai/) and check the **Alerts** and **Cases** tabs for the triaged report.

If the report does not appear, confirm the following:

* The forwarding address in **Send Non-Simulated Emails to** is exactly `alerts@report.radiantsecurity.ai`.
* The user who reported the test message has the latest PAB configuration (KnowBe4 propagation may take time).
* The reporter's domain is enabled in [Radiant's Monitored Domains](https://app.radiantsecurity.ai/settings/organization/phishing-configuration) tab.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://help.radiantsecurity.ai/radiant-connectors/connectors-and-data-ingestion/phishing-email-forwarding-overview/forward-phishing-emails-from-knowbe4.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.