Allows you to choose whether real reported emails are saved in the SIEM Inbox for review, or forwarded directly to the configured notification email.
Ensures that the report event is always logged in the campaign, even when the SIEM Inbox is not active.
Ensures that the .eml file always reaches the configured email, regardless of the toggle state.
Differentiates the behavior of moving to SPAM depending on the email client (Google Workspace vs. Microsoft Outlook), without the toggle affecting it.
Navigation: Settings → Report Button
In the Report Button settings section you will find:
The Emails field where you enter the emails that will receive report notifications.
The "Save reported emails in SIEM Inbox" toggle.
What does this toggle do?
Enabled: reported emails are stored in the platform's SIEM Inbox and immediately forwarded to the configured notification email.
Disabled: reported emails are not stored in the SIEM Inbox. Only the
.emlis forwarded to the configured email.
The complete behavior by email client:
Google Workspace (Gmail)
Action | Toggle disabled | Toggle enabled |
|---|---|---|
Real email → SIEM Inbox | ❌ Not saved | ✅ Saved |
Real email → move to SPAM | ❌ Not moved | ❌ Not moved |
Sending of | ✅ Always | ✅ Always |
Campaign email → "reported" event | ✅ Always | ✅ Always |
Campaign email → move to SPAM | ❌ Not moved | ❌ Not moved |
Microsoft Outlook
Action | Toggle disabled | Toggle enabled |
|---|---|---|
Real email → SIEM Inbox | ❌ Not saved | ✅ Saved |
Real email → move to SPAM | ✅ Always | ✅ Always |
Sending of | ✅ Always | ✅ Always |
Campaign email → "reported" event | ✅ Always | ✅ Always |
Campaign email → move to SPAM | ❌ Not moved | ❌ Not moved |
Difference between clients: in Microsoft Outlook, real emails are always moved to SPAM when reported, regardless of the toggle state. In Google Workspace, this never happens because the tool does not allow it.
Campaign emails (simulations) are never moved to SPAM in any client or configuration.
If the toggle is disabled, does the report event disappear from the campaign?
No. The "reported" event is always logged in the campaign if the email was a simulation, regardless of the toggle state.
Is the .eml only sent if the toggle is enabled?
No. The .eml is always sent to the configured email, whether the toggle is enabled or disabled.
What is the difference between having the toggle enabled or disabled?
With the toggle enabled, the reported email is saved in the SIEM Inbox and also forwarded to the configured email. With the toggle disabled, the email is not saved in the SIEM — only the .eml is forwarded.
Why does the real email in Outlook move to SPAM even though the toggle is disabled?
Moving to SPAM in Outlook is a behavior of the email client, not of the toggle. The toggle only affects whether the email is saved in the SIEM Inbox.
Can simulation emails end up in SPAM?
No. Campaign emails never move to SPAM in any client or configuration.
Do you have feedback or want to request improvements? Let us know at
