INKY Dashboard

Team

Alert

Unique Primary Recipients

Message Count

Sender Type

Analysis Results

Analysis Results by Date

Threat Types

Threat Details

Minimum threat level:

Reason:

Reported Messages:

Message-ID:

Recipient Email Address:

Suppressed Results:

Filter by Selected Date Range

Visit the Visualization Dashboard for more advanced search and filtering

Customize INKY for

Banner Links

You may customize some of the links that appear in banners applied to mail by INKY. To adjust which banners get applied to mail in general, use the Settings section. If you want to return to the system default configuration, click here to .

Branding link text: (leave blank to omit)

Branding URL:

FAQ link text: (leave blank to omit this)

FAQ URL:

Sensitive Content Policy Messages & Links

When INKY detects sensitive content in messages, you may configure a custom policy message (and optionally link to a web site for more information) based on the category of sensitive content detected. Some basic HTML formatting is allowed (i.e., <u>, <i>). To not show any special message, leave the fields blank. To disable the detection of a category altogether, uncheck the corresponding checkbox. If you want to return to the system default configuration, click here to restore defaults.

Password policy text: (leave blank to omit)

Linked URL: (optional)

Enable detection of password and account-related sensitive content

Financial policy text: (leave blank to omit)

Linked URL: (optional)

Enable detection of financial-related sensitive content

COVID-19/Coronavirus policy text: (leave blank to omit)

Linked URL: (optional)

Enable detection of COVID-19 and coronavirus-related sensitive content

Landing Page Branding

You may customize the landing pages that your end users will reach when clicking the Report This Email or Details links in banners. The settings also apply to the Link Protection pages if you have the Link Rewriting feature enabled. If you want to return to the system default configuration, click here to restore defaults.

Use custom logo as header image

Header text: (leave blank for default)

Header URL: (leave blank to not link anywhere)

Preview Customizations for

Allow List for

The allow list entries here cause INKY to suppress certain types of results and should be used with caution. New entries can be added via the Threat Details section.

Add to Allow List for

You may manually add allow list entries to ensure messages with certain criteria never receive a particular result type. The criteria value can be a comma-separated list of email addresses or domains. Caution: Be sure to preview your results with the dry-run option. There is no bulk-undo capability. Any undesirable entries may be disabled individually.

Result Type:

Criteria
(CSV list of emails, domains):

Block List for

The block list entries here force INKY to assign certain types of results and should be used with caution. New entries can be added via the Threat Details section or via the form at the bottom of this screen.

Add to Block List for

You may manually add block list entries to force messages with certain criteria to always receive a particular result type. The criteria value can be a comma-separated list of email addresses, domains, and/or IP addresses. Caution: Be sure to preview your results with the dry-run option. There is no bulk-undo capability. Any undesirable entries may be disabled individually.

Result Type:

Criteria
(CSV list of emails, domains, IPs):

Microsoft Graph API Access Configuration

Domain and Directory Access

INKY uses the Microsoft Graph API to check your tenant's domain and directory information to help ensure you stay protected. This requires you to log in with an Office 365 or Exchange global administrator account. Note: Once this access is granted, you may use the "Check for Missing Domains" tool under Advanced Config > Domain Information; please report any missing domains to INKY support.

Basic Read-Only Mail Access

INKY can improve its results if you provide API access to your organization's mail and directory information. Note that this requires you to log in with an Office 365 or Exchange global administrator account.

INKY Phish Finder

This tool scans historical (already delivered) mail in group members' inboxes to allow you to preview INKY analysis results in the dashboard before a full deployment. This helps detect potentially dangerous emails currently in users' mailboxes and also helps identify potential domain-specific allow list requirements.

Step 1: Click to find an up-to-date list of INKY groups that you can scan.

User Mailbox Check

This option allows you to check how many unique mailboxes INKY has processed mail for (in the currently selected time period).

Remediation Access

To enable remediation actions via the dashboard, such as removing dangerous messages from user mailboxes, you may grant additional read/write permissions to INKY. Note that this requires you to log in with an Office 365 or Exchange global administrator account. The INKY service will not remove any messages automatically; only an authorized administrator can invoke the remediation actions.

Google API Access Configuration

Domain and Directory Access

INKY uses the Google Directory API to check your tenant's domain and directory information to help ensure you stay protected. Note that this requires you to log into your G Suite Admin Console and configure your tenant to allow access by INKY's service account. Note: Once this access is granted, you may use the "Check for Missing Domains" tool under Advanced Config > Domain Information; please report any missing domains to INKY support.

Instructions:

Go to the Google Admin console and follow the instructions for setting up Domain-Wide Delegation with the following details:
- Client ID:
- Scopes:
  - https://www.googleapis.com/auth/admin.directory.user.readonly
  - https://www.googleapis.com/auth/admin.directory.domain.readonly
  - https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly
  - https://www.googleapis.com/auth/admin.directory.group.readonly
After granting access to our app, click the button below to verify. Note that the access may take anywhere from one hour up to 24 hours to take effect.

Remediation Access

To enable remediation actions via the dashboard, such as removing dangerous messages from user mailboxes, you may grant read/write permissions to INKY. Note that this requires you to log into your G Suite Admin Console and configure your tenant to allow access by INKY's service account. The INKY service will not remove any messages automatically; only an authorized administrator can invoke the remediation actions.

Instructions:

Go to the Google Admin console and follow the instructions for setting up Domain-Wide Delegation with the following details:
- Client ID:
- Scopes: https://www.googleapis.com/auth/gmail.modify
After granting access to our app, click the button below to verify. Note that the access may take anywhere from one hour up to 24 hours to take effect.

Advanced Configuration

Learning Mode

INKY can be configured to run in "learning mode." During this time, some special consideration will be given to the fact that INKY was just recently enabled. This includes a learning mode link in INKY's banners (which leads to the Report This Email page). The Report This Email and Details pages also include an added reminder that INKY was newly added and solicits additional feedback.

Learning mode is ON/OFF until

During this time, your users will not see certain results in the INKY banner (i.e., ), but INKY will let you review these so-called "Suppressed Results" in Threat Details. During the learning mode period, you should review these results and apply any appropriate allow list or policy changes until all the suppressed results are real threats.

Upstream Provider

If your organization uses an additional upstream provider, update this section to help INKY produce the most accurate results possible. If you use an upstream provider not listed here, please contact your support representative.

Provider Type:

Phishing Awareness Training Platforms

Update this section if your organization runs phishing awareness campaigns using one or more of the platforms listed below, and you would like to customize INKY's behaviors for simulated phishing messages originating from these platforms. If you use a platform not listed here, please contact your support representative.

Platforms:

Note: To select or deselect, press ⌘ (on Mac) or Ctrl (on Windows) while clicking.

Custom Banner:

Bypass link rewriting for all links in simulated phishing messages

Always deliver simulated phishing messages to the user's Inbox (only applies if using INKY's Delivery Settings)

Do not attach raw messages to reports for simulated phishing messages^†

Send email notifications to different addresses when users report simulated phishing messages^†

Send to:

^† By default, notifications will follow the settings listed under Settings > Custom Reporting Email Notifications

KnowBe4 Phish Alert Integration

If your organization uses KnowBe4's Phish Alert Button, enter the license key found on your KnowBe4 Account Settings page. Doing so will cause INKY to notify KnowBe4 whenever a user successfully identifies a phishing simulation using INKY's Report This Email functionality. In addition, INKY will forward non-simulated phishing emails to any custom addresses that you have configured within KnowBe4.

License Key:

Domain Configuration

This is a view of your current domain configuration within INKY. Please contact your support representative to request any changes. Note that a next-hop destination in brackets like [host] means MX DNS lookups are disabled; the A record will be used instead.

DMARC Monitoring

Your Sender Authentication Configuration (DMARC, SPF, & DKIM Records)

This section presents the status of several DNS records related to sender authentication for your team. For each domain assigned to your team, you will see the status of the DMARC and SPF records, which exist at well-known DNS records. Also, if INKY is a recipient of DMARC aggregate report emails, you will see the status of DKIM records that have been reported to INKY as being used by mail senders. Furthermore, we list relevant records of any subdomains that have been reported via DMARC reports (i.e., subdomains observed in the wild appearing in the From header or as the envelope sender).

DMARC Setup Instructions

In order for INKY to collect data on mail being sent by your domains (or spoofing your domains), you must add the following DNS record for all of your domains.

DMARC Aggregate Report Data

Below is data aggregated from DMARC reports received by INKY based on any DMARC DNS records configured according to the above instructions.

Group By: Subgroup By: Sort:

Tools

INKY Link Decoder

Use this tool to decode an INKY-rewritten link to obtain the original URL and related message details. Note: You may only decode links in messages you are permitted to view as an INKY team administrator.

Rewritten Link:

Other Tools

Here are links to other INKY tools.

Manage Microsoft 365 Deployments:
To configure INKY for a new or existing team, please visit the INKY Phish Fence for Office 365 Discovery and Deployment site.

Hide the following non-critical results