Skip to main content

Reporting Integration with KB4

How to set up the KnowBe4 PhishER webhook integration to forward reported phishing emails into revel8 for analysis

Updated over 3 weeks ago

🔗 1: Create the Webhook in KnowBe4 PhishER

  1. Go to Settings → Integrations → Webhooks → Add Webhook

  2. Fill in:

    • Name: revel8

    • URL: https://hook.eu1.make.com/{your_custom_hook}

    • Available Data: check Headers (you can leave the rest unchecked)

  3. Click Save/Update

🧠 2: Create the Rule (match our header)

  1. Navigate to PhishER → Rules → New Rule

  2. Set:

    • Name: revel8 - header match

    • (Optional) Set Tag: revel8

  3. Create Strings: add a string for our header

    • Example: $string_1 = "X-CS-OID: <Your Org ID>"

  4. Condition: set any of them to match when the header is present

  5. Click Save

📤 3: Create the Action (forward via webhook)

  1. Go to PhishER → Actions → New Action

  2. Configure:

    • Name: revel8 Forward

    • Trigger: Specify Tags → Has → Only → revel8 (or whichever tag you set in the rule)

    • Report this action: Send to Webhook → select "revel8" (the webhook from Step 1)

  3. Click Save

📨 4. Header Description (what we’re looking for)

  1. Header name: X-CS-OID

  2. Purpose: identifies CompanyShield simulation reports

  3. Example format: X-CS-OID: <your-org-or-tenant-id>

📌 Requirements & Notes

  • Ensure your Make.com custom webhook is active and accessible from KnowBe4

  • The rule must tag items (e.g., revel8) so the action trigger can scope correctly

  • The header string must match exactly (including the "X-CS-OID" prefix)

✅ Final Checklist

  • Webhook revel8 created with URL https://hook.eu1.make.com/{your_custom_hook}

  • Headers selected under Available Data

  • Rule "revel8 – header match" created

  • String added for header (e.g. $string_1 = "X-CS-OID: <Your Org ID>")

  • Condition set to any of them to match header presence

  • Action "revel8 Forward" created

  • Trigger set to Specify Tags → Has → Only → revel8

  • Action set to Send to Webhook → revel8

Did this answer your question?