> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-reference/dashboards/phishing-dashboard.md). # Phishing Dashboard [Expel Managed Phishing](/more-features/expel-managed-phishing.md) means your SOC analysts do not have to investigate suspicious emails. Our SOC analysts investigate each reported email, tell you when they’re real phishing attempts, remove the email from all inboxes (if you configure [auto remediations](/workbench-setup/auto-remediations/about-auto-remediations.md)), and close the loop with your employees. You only need to deal with phishing emails if we assign you a [Remediation Action](/workbench-reference/expel-terminology.md#remediation-action). To open the Phishing Dashboard, go to **Dashboards > Phishing**. {% hint style="info" %} If your company has not signed up yet for Expel Managed Phishing, you see example data. {% endhint %} This dashboard shows you details about the state of suspicious emails and submitters within your organization. Remember, in the upper left of this dashboard, you can select the time period you want to view.
An image of the phishing dashboard.
Submissions by outcome over time The chart visually shows the rate of email submissions over time. You can select and clear the kinds of submissions you want to view on the chart. On the left of this area, you see trends for Unique Malicious Senders and Unique Submitters.
Total emails to incidents The chart shows the ratio of various types of submissions. You can see how many emails from total submissions funnel down to incidents. You can select and clear the kinds of submissions you want to view on the chart.
Frequent submitters of This area shows a list of the people in your organization who submitted the most emails overall and their accuracy at identifying true positives. Select from the list to see top reporters of malicious and benign emails. You see the number of submissions, the accuracy of the submissions, and the email of the submitter. You can download this list if you need it for training, for example. The user ragj, for example, has a low accuracy rate and might benefit from some training.
Malicious attachments This chart shows you how many and what kinds of attachments are being found. In this example, zip files are most prevalent. You might want to block these attachment types. {% hint style="warning" %} We only include attachment types with the mime type application at this time. {% endhint %}
Actions using your tech during investigations and incidents This chart shows technologies we're using to perform investigative actions to gather information. You can select and clear the kinds of tech shown.
Frequent domains in A list of the domains that appear most frequently in your phishing submissions. Select from the list to see specific email types. These may be in links in the body of the email. You can download this list if you need it for training, for example. Consider blocking the malicious domains in your email gateway.
Most reported malicious emails A list of the subject lines in the submitted phishing submissions. You can see if there are common themes among malicious emails for the time period, so that you can get a sense of what kind of phishing campaigns your users are receiving. You can download this list if you need it for training, for example.
Malicious sender domains A list of the sender domains in the submitted phishing submissions. You can create rules to block specific recurring malicious domains. You can download this list if you need it for training, for example.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.expel.io/workbench-reference/dashboards/phishing-dashboard.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.