Introduction
Access & users
Training & culture
Phishing & defense
Communication & reports
Analytics
Employee portal

PhishER

Triage of the real emails your employees report as suspicious, with auto-detection of your own simulations.

From testing tool to defense platform

Simulating phishing measures risk. PhishER closes the loop: when an employee receives a genuinely suspicious email and reports it, it lands in a triage queue for the security team to classify and act on. This is what turns qlture from a “simulation tool” into a defense platform.

You’ll find it all under the Triage tab (Reported phishing), inside the Phishing module (TENANT_ADMIN / TENANT_MANAGER access).

Reported email triage screen in the qlture dashboard
Reported phishing: a triage queue with counters per status and the Configure inbox button.

The status of a report

Each reported email moves along a pipeline:

Status Meaning
new Just arrived, awaiting triage
triaging Under analysis
malicious Confirmed malicious
spam Spam/junk, not malicious
safe False alarm: a legitimate email
simulation It’s a simulation from qlture itself (auto-detected)

The differentiator: simulation auto-detection

When a report arrives, qlture extracts the IOCs (URLs and domains) and looks for the tracking tokens from your own campaigns (the /c, /r, /o and /p routes). If any token matches a target/campaign in your tenant, the report is automatically flagged as simulation.

The result: your team doesn’t waste time triaging the training emails you sent yourself. This uses data that is already yours, with no extra configuration.

flowchart TD
  E[Employee forwards<br/>a suspicious email] --> IN[qlture ingestion]
  IN --> X[Extracts IOCs + tracking tokens]
  X --> M{Matches one<br/>of your campaigns?}
  M -->|Yes| SIM[Flag as simulation]
  M -->|No| T[SOC triage queue]
  classDef hl fill:#c6ff00,stroke:#c6ff00,color:#070a0e;
  class T hl

How an employee reports

There are two entry points, and both feed the same triage queue.

1. Token ingestion (API)

An endpoint receives the reported email, authenticated by a per-tenant bearer token. We store only the hash of the token (same pattern as SCIM). Generate and rotate the token under Triage → Configure inbox.

2. Email forwarding (forward)

The employee forwards the suspicious email to a dedicated address for your tenant:

report-<code>@<your-reports-domain>

The customer’s email router (AWS SES inbound, Mailgun or Cloudflare Email Routing) posts the message to qlture, which unwraps it.

Ask the employee to forward the suspicious message AS AN ATTACHMENT (.eml). With inline forwarding, the bait's original sender is lost; as an attachment, qlture recovers the original email and correctly flags who reported it.

What the SOC sees

Under the Triage tab:

  • Stats per status, clickable to filter the list.
  • The list of reports.
  • A detail modal: the extracted IOCs (URLs/domains), the email body and the classification buttons (malicious, spam, safe…).

Every triage action and token rotation is recorded in the audit log.

Enable the email inbox (operational)

The code is ready; wiring up inbound routing is an infrastructure configuration. The recommended path (AWS stack) is:

  1. Verify the reports domain in SES (reports.your-domain), in a region with inbound (us-east-1, us-west-2 or eu-west-1).
  2. Point the domain’s MX record to inbound-smtp.<region>.amazonaws.com.
  3. Create a receipt rule that writes the raw message to an S3 bucket (with a policy allowing PutObject to ses.amazonaws.com).
  4. A Lambda function reads the raw email from S3, extracts the code from the report-<code>@ address, and does a POST to qlture’s inbound endpoint with the shared secret in the header.

The variables that enable the feature on the backend:

REPORT_INBOUND_SECRET=<openssl rand -hex 32>
REPORT_INBOUND_DOMAIN=reports.your-domain

If your DNS is on Cloudflare, there's a simpler path: Email Routing + an Email Worker that does the same POST — no SES, S3 or Lambda.

Once inbound is enabled on the server, the configuration card on the Triage screen starts showing your tenant’s report address.

Roadmap

Planned but not yet available: a 1-click add-in for Outlook/Gmail (an alternative to forwarding), clawback (removing the malicious email from mailboxes), and attachment storage.

Senders, templates and pages
Announcements
Next →

Related Docs

Introduction
Access & users
Training & culture
Phishing & defense
Communication & reports
Analytics
Employee portal