Phishing Submission Button Setup

Step 1: Install the Extension

1. Log in to Google Workspace as an administrator.
2. From the Admin Console, select Devices.

1. In the navigation pane of the Devices page, select Chrome > Apps & extensions > Users & browsers.

1. In the lower right corner of the page, select the yellow + button and then select Add Chrome app or extension by ID.

1. In the box that appears, enter the extension ID: gpkcimdiphdhnenbncknfiakplflhmnc.
2. Select Save.
3. Select the arrow next to the extension and choose Force install.

Step 2: Configure the Extension for All Users

1. With the Expel Phishing extension selected, an option panel appears on the right. In that option panel, locate the Policy for extensions field.

1. The Policy for extensions field expects a JSON block. Our custom JSON configuration accepts three parameters:

destinations_forward_attachment REQUIRED (array of strings)
- Where the submitted phishing emails will be forwarded to as an attachment. 

 This is where the Expel Phishing alias provided by the EM should be entered.

destinations_forward_inline (array of strings)
- Where submitted phishing emails will be forwarded to inline.

valid_domains REQUIRED (array of strings)
- List of domains for which the button appears

(for example, if gmail.com is included, users logging into 
personal Gmail accounts see the button).

custom_success_message (string)
- Customized success message to show on submission of email to Expel Phishing.

move_to_trash (boolean) DEFAULT is true - Set to false and the button leaves the original 

message in the user’s inbox. If set to true, the button moves the original message to the trash folder upon submission.

{
"customConfig":{
“Value”:{
“destinations_forward_attachment”: [“alias@expel-phishing.io”],
“valid_domains”: [“company.com”],
“custom_success_message”: “Thank you for being vigilant! The security team is looking into this and will update you shortly.”
}
}
}

{
"customConfig":{
“Value”:{
“destinations_forward_attachment”: [
“phishingreport@company.com”,
“alias@expel-phishing.io”
],
“valid_domains”: [“company.com”]
}
}
}

{
"customConfig":{
“Value”:{
“destinations_forward_attachment”: [“alias@expel-phishing.io”],
“destinations_forward_inline”: [“security@company.com”],
“valid_domains”: [“company.com”]
}
}
}

{
"customConfig":{
“Value”:{
“destinations_forward_attachment”:
[“alias@expel-phishing.io”, “security@company.com”],
“valid_domains”: [“company.com”, “gmail.com”]
}
}
}

1. Select SAVE to complete the configuration.

Step 3: Allowlist the Extension

1. Go back to the Admin console and select Security.

1. Scroll down and open App access control.

1. Select MANAGE THIRD-PARTY APP ACCESS.
2. In the Connected apps section, hover over Expel Phishing and select Change access.
3. Choose Trusted: Can access all Google services and then select SAVE.

Step 4: Enable Domain-wide Delegation

1. Go back to the Admin console and select Security.

1. Scroll down and open App access control.

1. Select MANAGE DOMAIN WIDE DELEGATION.

1. Select Add new.

1. Enter the following for the Client ID and the OAuth Scopes:

• Client ID: 528472867238-v8803num13j6691ue52qqm6tuoqpu9ns.apps.googleusercontent.com
• OAuth scopes: https://www.googleapis.com/auth/gmail.modify

Step 1: Create a Google Workspace Add-on Project

1. Navigate to https://script.google.com/ and log in as the domain super admin.
2. Select New project.

1. Select Untitled project, rename the project "Report potential phishing", and then select Rename.
2. Select the plus sign (+) next to Files, and then select Script.

1. Enter "Config" as the file name and press Enter.
2. At the bottom of the navigation bar, select the Settings icon.

1. Select the Show "appscript.json" manifest file in editor checkbox.
2. In the navigation bar, select the Code Editor (<>) icon.
3. Using the GmailAddOn.zip file, extract, copy, and paste the contents of each file into the corresponding files in the Apps Script editor.
4. After the files are copied into and saved in the Apps Script editor, select Deploy > New deployment.

1. Select the gear icon next to Select type, and then select Web app and Add-on.

1. On the Configuration pane, do the following:

   • In the New description field, enter "Report potential phishing".
   • In the Who has access field, select the Anyone within… option.
   • Select Deploy.
2. After the deployment is complete, copy and save the Deployment ID for use in a later step.

Step 2: Create a Google Workspace Cloud Project

1. In a new browser tab, navigate to https://console.cloud.google.com/projectcreate.
2. Enter "Report Potential Phishing" as the project name and select CREATE.
3. From the menu on the left, select APIs & Services > Enabled APIs & Services.

1. Search for and select the Google Workspace Marketplace SDK.
2. Select ENABLE.
3. Select the App Configuration tab.

1. Select The OAuth Consent Screen must be enabled for this project hyperlink.
2. On the OAuth consent screen:

   • Select Internal as the User Type.
   • Select CREATE.
3. Complete the following fields, leaving the rest empty:

   • App name - Report potential phishing.
   • User support email - enter an email address for the security team/help desk where end users can direct general questions if they have any.
   • Developer contact information - support@expel.com.
4. Select SAVE AND CONTINUE.
5. Select ADD OR REMOVE SCOPES.
6. In the Update selected scopes area that opens, copy the following scopes into the Manually add scopes box:

   • https://www.googleapis.com/auth/gmail.addons.execute
   • https://www.googleapis.com/auth/gmail.addons.current.message.readonly
   • https://www.googleapis.com/auth/gmail.send
7. Select ADD TO TABLE.
8. Verify that the following scopes are added to the table and chosen, and then select UPDATE.

1. The Edit app registration page appears, showing the three scopes. Scroll to the bottom of the page and select SAVE AND CONTINUE.

Step 3: Connect Google Workspace Cloud and Add-on Projects

1. Navigate to https://console.cloud.google.com/apis/api/appsmarket-component.googleapis.com/googleapps_sdk.
2. Copy the App ID, as you will need it shortly.

1. Return to the Apps Script tab, or navigate to the Report potential phishing project at https://script.google.com.
2. Navigate to Project Settings, and select Change project at the bottom of the page.

1. In the GCP Project Number field, paste in the App ID you copied from the App Configuration screen and then select Set project.
2. Go back to the API & Services cloud console tab and then do the following on the App Configuration Screen:

   • Select the Google Workspace Add-on checkbox.
   • Select the Deploy using Apps Script deployment id option.
   • Enter the Deployment ID you copied and saved in Step 1.
3. In the OAuth Scopes section, select ADD SCOPE and then add these three scopes (you will have two default scopes already, bringing the total to five scopes):

   • https://www.googleapis.com/auth/gmail.addons.execute
   • https://www.googleapis.com/auth/gmail.addons.current.message.readonly
   • https://www.googleapis.com/auth/gmail.send
4. Select the following options:

   • In Installation Settings, select Admin Only Install.
   • In App Visibility, select Private.
   • Select SAVE.
5. Scroll to Developer Links and enter the following:

   • Developer Name - Expel
   • Developer Website URL - https://expel.io
   • Developer Email - support@expel.io
6. Select the Store Listing tab.

1. Under App Details, next to English, select the down arrow.
2. Fill in the following App Details fields:

   • Application Name - Report potential phishing
   • Short Description - Report potential phishing emails
   • Detailed Description - Utility to help send potential phishing emails for triage

1. Select DONE.
2. Fill in the following remaining fields:

   • Category - Administration and Management
   • Graphic Assets (select BROWSE and upload the images from the zip file):

     • Application Icon 32x32 - 32x32.png
     • Application Icon 128x128 - 128x128.png
     • Application Card Banner - 128x128.png
   • Screenshot (select BROWSE and upload the image from the zip file) - 80x80.png
   • Support Links:

     • Terms of Service URL - https://expel.io
     • Privacy Policy URL - https://expel.io
     • Support URL - https://support.expel.io
3. Distribution - select All Regions or select from the Regions list.
4. Select PUBLISH.

Step 4: Install the Add-on to the Domain

1. Navigate to https://gsuite.google.com/marketplace/mydomainapps.
2. Select the Report phishing app and then choose Domain Install.
3. In the Domain wide install area, select CONTINUE.
4. On the OAuth Consent Screen, agree to the terms of service and then select ALLOW.
5. In the success message window, select DONE.

Deploy Add-in Using the 365 Admin Center

1. Log in to the Microsoft 365 admin center.
2. In the navigation menu on the left, go to Settings > Integrated Apps.
3. Near the top of the page, select Add-Ins.
4. In the tab that appears, select Deploy Add-in.
5. Select Next and then select Upload custom apps.
6. In the Deploy a new add-in section, do the following:

   • Select I have the manifest file (.xml) on this device.
   • Select Choose File.
   • Find and select the manifest file.
   • Select Upload.
7. In the Configure add-in section, do the following:

   • Under Assign Users, decide to which users to deploy the add-in.
   • Under Deployment Method, select Fixed (Default).
   • Select Deploy.