If your employees already report phishing with the KnowBe4 Phish Alert Button (PAB), you do not need a second button. This integration forwards the reports that belong to revel8 simulations, so your reporting rate shows up in the platform.
How it works: an employee reports a mail with the PAB, and it lands in the PhishER inbox. A rule recognizes revel8 simulations by a header and tags them revel8. An action then forwards those tagged messages to revel8 over a webhook. Real phishing reports are untouched and continue to PhishER and your SOC as before.
Before you begin
Have these ready:
PhishER admin access, with rights to edit Rules and Actions.
Your organization ID, which revel8 provides. It appears in the simulation header as
X-CS-OID: <your-org-id>.The webhook URL for your organization, which revel8 provides.
1. Create the webhook
Open Settings → Integrations → Webhooks → Add Webhook.
Set Name to
revel8.Paste the URL revel8 gave you.
Under Available Data, tick Headers. Leave the rest unticked.
Click Save.
2. Create the rule that recognizes revel8 simulations
Open PhishER → Rules → New Rule.
Set Name to
revel8 - header match.Under Set Tag, enter
revel8.Under Create Strings, add the header string for your organization:
$string_1 = "X-CS-OID: <your-org-id>"
Set the Condition to any of them, so the rule matches whenever the header is present.
Click Save.
The header has to match exactly, including the X-CS-OID prefix. It is what tells revel8 simulations apart from real reported mail, so nothing else is forwarded.
3. Create the action that forwards to revel8
Open PhishER → Actions → New Action.
Set Name to
revel8 Forward.Under Specify Tags, set the condition to has and the tag to
revel8.Leave doesn't have empty.
Under the action itself, choose Send to Webhook and select the
revel8webhook from step 1.Click Save Action.
⚠️ Warning
Do not use has only. A reported mail always carries at least two tags in PhishER: the reporting tag PhishER assigns automatically, plus the revel8 tag from your rule. has only requires revel8 to be the single tag, so it can never match and the webhook never fires.
💡 Tip
Optionally enable Delete matching messages from PhishER inbox in this action, so forwarded simulations do not pile up in the inbox. Real phishing reports are unaffected.
4. Move the action to the top of the action order
PhishER runs actions in the order they appear in the Actions list. If the forward action sits near the bottom, an earlier action can process the message first and the forward never runs.
Open PhishER → Actions in the left navigation, below Rules.
Open Action Order.
Drag revel8 Forward to the first position.
Click Save Action Order.
Unlike rules, the action order needs no separate apply step. Saving is enough.
5. Apply your rule changes
Saving a rule does not activate it. PhishER shows a banner reading "One rule has not been applied. To activate the rule, click the apply changes button". Click Apply Changes at the top right to make the rule live.
📝 Note
If a rule is not taking effect, check for an open apply banner before you change any configuration. An unapplied rule is the most common reason a correct setup appears broken.
6. Verify the setup
Send a test simulation and have the recipient report it with the PAB.
In the PhishER inbox, confirm the message carries the
revel8tag.In PhishER → Rules, confirm the match counter on your header-match rule has gone up.
In revel8, confirm the report appears: the reporting rate in Human Risk Monitor → Overview, and the event in Playlist.
If step 2 works but step 4 does not, the rule is fine and the problem is in the action. See the troubleshooting below.
Troubleshooting
The revel8 tag is set, but nothing arrives in revel8
The revel8 tag is set, but nothing arrives in revel8
The rule is working and the action is not. There are two usual causes, and they often occur together: the forward action sits too far down the action order, so an earlier action handles the message first (step 4), or the trigger is set to has only instead of has, which can never match because reported mail always carries more than one tag (step 3).
A change to the rule had no effect
A change to the rule had no effect
Rule changes stay inactive until they are applied. Look for the banner at the top of PhishER and click Apply Changes. This does not apply to actions or to the action order, which take effect on save.
Real phishing reports should not reach revel8
Real phishing reports should not reach revel8
They do not. Only messages carrying the revel8 tag are forwarded, and that tag is set solely by the header-match rule, which matches the header revel8 puts on its own simulations. Everything else stays in PhishER and follows your normal process.