> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/more-features/expel-managed-phishing/customer-questionnaire.md). # Customer Questionnaire By answering the following questions, you can better prepare for implementing Expel Managed Phishing. For more information, see [About Expel Managed Phishing](/more-features/expel-managed-phishing/about-expel-managed-phishing.md). ## General Questions Answers to the questions in this section are helpful but not required for initial onboarding. * Which email service do you use? * What email gateway do you use? * How many email submissions are you getting on average per day? How many on average, per day, are confirmed malicious? * What actions do you take today on confirmed phishing emails? For example, delete all sent emails globally, block sender, block malicious urls, hashes, and so on. What vendor tools do you use to take each of these actions? * Where are your email trace logs stored and are they accessible to Expel? ## Sending and Receiving Emails * What is the email domain we should expect to see phishing submissions coming from? * Do you need to create allow lists or establish trust anywhere in your environment for forwarded phishing email communications? If yes, the following are the involved addresses: * **Outbound** - Custom forwarding email (provided by Expel): `@expel-phishing.io` * **Inbound** - Acknowledgement and outcome response emails from Expel: `soc@expel.io` ### Phishing Submission Buttons * Expel has add-on buttons for Google Workspace and Microsoft 365 for phishing submissions. * What is your typical timeline for deployment of this type of add-on? * Let your Expel Customer Success Manager (CSM) know if you anticipate any significant delays in deploying the button. {% hint style="info" %} If you have a different email provider or the button cannot be deployed, you can forward your suspected emails to us as an EML attachment by using your [custom email forwarding destination](#user-content-fn-1)[^1]. {% endhint %} ### Expel Email Responses * Do you want Expel to send phishing outcome responses sourced from your security team email (adjustment of `from` header)? * If your `Alignment Mode` for DKIM/SPF is set to relaxed, (it is by default unless otherwise overridden) Expel generates a set of DKIM/SPF records which you need to add through your DNS provider. * If your `Alignment Mode` for DKIM/SPF is set to strict, we need to have further discussions on how to best accommodate this setup. * If yes, do you use DKIM/DMARC? * If yes, how often do you run them? What vendor do you use? * Do you run phishing simulations? * Do you have a logo you can provide us for branding our responses back to your submitters? * If yes, provide it to your CSM. Preference: 140 pixels wide, .png file. * What would you like responses to your submitters for the following to be? ## Acknowledgement Emails This is when we acknowledge we received the submission. ### Default response: Hello, Thanks for reporting a suspected phishing attempt. We’ll examine the provided email content and follow up when we’re done. If we find malicious content, we’ll include recommended next steps. In the meantime, leave the suspect email alone. Don’t download attachments, click links, or reply to the sender. Thank you, Security Team ## Benign/Safe Email Outcomes This is after we've investigated and confirmed the email is safe to interact with. ### Default response: Hello, We've found the email “{subject}” to be a legitimate email which you're free to respond to, if needed. We appreciate your vigilance! Thank you, Security Team ## Malicious/Not Safe Outcomes This is after we've investigated and confirmed the email is malicious and not safe to interact with. ### Default response: Hello, After investigation, we've identified the email “{subject}” as not safe and we are working on remediating. Please refrain from interacting with email or sender in the meantime. We appreciate your vigilance! Thank you, Security Team ## Simulation Emails This is after we receive a submission resulting from a phishing simulation exercise. ### Default response: Hello, Congratulations! You identified the email “{subject}” as phishing, and it was in fact sent as a phishing simulation for training purposes. Continue to stay vigilant! Thank you, Security Team
[^1]: To view your custom email forwarding destination, go to [Organization Settings > My Organizations](https://workbench.expel.io/settings/organizations/), scroll down to the **Phishing** tab, and look for the **Destination Address**. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.expel.io/more-features/expel-managed-phishing/customer-questionnaire.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.