Account Settings

Overview

The Account Settings page is where you can configure default settings for campaigns, account notifications, portal user password policy, portal SSO, EVENTS, and MFA settings. 

To navigate to Account Settings, expand Administration > Settings > Account Settings.

Use the links below to jump to a section:

1. General
2. Notifications
3. Passwords
4. SSO
5. EVENTS
6. MFA
7. Webhook

General

The General tab lets you specify certain default settings on your account.

• Default Test Length - How long you want your tests to run. This value will be populated in the campaign wizard but can be modified during campaign setup.
• Default Time Zone - Will be automatically set in the date/time drop-downs in the campaign wizard. This value can be modified during campaign setup. 
• Default Email Rate Limit - The rate of emails per hour that will be sent out for the Immediate Test type. The minimum send rate is 10 emails per hour. There is not an upper limit to the sending rate; however, some firewalls will block phishing emails if you attempt to have too many sent over a short period of time. If this is a concern in your environment, then we recommend starting out with a relatively low sending rate - 300 per hour - and gradually increasing this as you run more tests.
• Group Import Type - This specifies how the system will handle imports when you attempt to import more targets than your account has available seats to hold. There are three options to choose from:
  • Stop and do not import - The import will fail entirely. No targets will be imported.
  • Import up to the available amount - Imports up to the available amount of seats and stops importing emails.
  • Import all and send a bill for the overage - Imports all the targets. If you go over your seat limit, then you will be billed for the excess.
• Default Date Format for Reports - The default date format displayed in Report Generator and Report Generator BG.
• Default Time Format for Reports - The default time format displayed in Report Generator and Report Generator BG.

Back to top

Notifications

The Notifications tab allows you specify an account manager and provides several notification options you can enable/disable.

• Group Sync Notification - A group_sync_complete system email is sent to all admins on the account letting them know when integrated groups (such as Entra ID, LDAP or Litmos) are synced.
• Flagged Domain Notification - An email is sent to the account manager email address when a domain that is being used in active tests is flagged (a domain may become flagged if it is marked as malicious by third party security software).
• Account No Usage Reminder - An email is sent to all admins to remind them to run a Phishing Campaign after 90 days of inactivity.
• Report Generated Notification - An email is sent to the user who queued for the report when their report is generated.

NOTE: Campaign notifications can be configured on the Review tab of the campaign wizard. 

Back to top

Passwords

The Passwords tab lets you specify the requirements that users must meet when creating/setting a new password.

Back to top

SSO

The SSO tab lets you configure single sign on for your PhishingBox portal account (School SSO can be configured in School Settings). You can choose from the available different SSO solutions (OneLogin, Okta, PingOne, Azure, and Google Workspace). 

NOTE: If a user is provided access to the phishing portal via your organization's SSO IDP and does not already have an account in the phishing portal (in Administration>Manage Portal Users), an account will automatically be created with a role of "Admin" when the user accesses the phishing portal via SSO.

• SSO Lock - If enabled, administrators can log in to the portal via SSO only. If the SSO configuration fails and administrators can no longer log in, you will have to contact PhishingBox support to disable this feature.
  

  NOTE: Portal MFA lock must be disabled to use SSO portal lock. 

• App embed link - Input your SSO app's access URL here. When a URL is provided here, a link to this URL will be included in system emails. If there is no URL provided, the system email will just include plain text stating they must login via SSO. 
• Signed Logout - Set this to 'Yes' if your IDP requires signed single log out requests.
• Attribute Mappings - Specify users provisioned via SSO to be set with User privileges (users provisioned via SSO will have Admin privileges by default). This is done by specifying an attribute name and value to identify the user. If a name is duplicated, it will be treated as an array. The array will be parsed for the given value to determine how the field should be assigned. You have the following Field options:
  • First Name - Specify an attribute Name whose Value will be used as the created user's first name.
  • Last Name - Specify an attribute Name whose Value will be used as the created user's last name.

  • Admin - Specify an attribute key-value pair that when matched will assign the admin role.

  • User - Specify an attribute key-value pair that when matched will assign the user role.

    NOTE: Attribute mappings are optional. They are not required for SSO to function.

Back to top

EVENTS

The EVENTS tab lets you configure automations that occur when a specific event occurs (i.e. campaign ends, target(s) added to group, etc.). 

Clicking the "Create New Event" button will open a pop-up that lets you create an event.

In the first tab, you must name the event, select the event type, and select the option that will trigger the event (under the Select drop-down). The available events are:

1. Add Target to a Group - When adding a target to a group you can enroll that target into a course or program.
2. When a campaign ends - Generate a campaign report when a campaign ends. This can be configured for a specific campaign, or for all campaigns (Target Campaign).
3. When a test ends - Generate a test report when a test ends. This can be configured for a specific test, or for all tests (Target Test).
4. Automated Report - Select reports to send on a scheduled basis. 

NOTE: "Run Report" will generate a report on PhishingBox. After the report has been generated, the admin who created the event will receive an email notifying them they can access the report on PhishingBox (if "Report Generated Notification" is turned on in the Notifications tab). "Send Report" will generate a report on the platform and send a .pdf via email to the defined email address(es). 

NOTE: Learn more about Automated and Campaign/Test Reporting.

After you define the event, the Choose Action Type tab allows you to choose the action(s) that will be taken when the event occurs. The Additional Configuration tab summarizes the event you are about to create.

Back to top

MFA

The MFA tab contains MFA Lock toggles to enable/disable required MFA for all users. When "MFA Lock Portal" is enabled, it will require all portal users to configure MFA. When "MFA Lock School" is enabled, it will require all students to configure MFA. 

Back to top

Webhook

The Webhook tab provides access to all account settings related to webhooks.

• Default Webhook (Deprecated) - When any action (verified or not) is recorded, the system sends a JSON response to the Default Webhook (Deprecated) URL. If a specific Webhook URL (Deprecated) is defined for a campaign, this URL will override the default and receive the response instead.
• Default Verified Action Webhook - When a verified action is recorded, the system sends a JSON response to the Default Verified Action Webhook URL. If a specific Verified Webhook URL is defined for a campaign, this URL will override the default and receive the response instead.
• Custom HTTP headers - Add custom HTTP headers to webhook requests. 

Back to top