The Coro email client add-ins enable protected users to provide feedback on potentially malicious emails or flag emails identified as threats by Coro as safe. Feedback submitted through the add-in is shared with IT personnel to support further action.
The Coro add-ins are compatible with web interfaces and native applications for:
- Gmail
- Microsoft Outlook 365
To use the Coro Gmail or Outlook 365 add-in, you must have:
- An active subscription to the Coro Email Security module
- One or more connected cloud applications
- Protected users
Coro's User Feedback add-in is not compatible with Outlook 2016 and Outlook 2019 on Windows under Microsoft Volume Licensing programs.
To learn about installing or removing the Coro add-in for Outlook 365, see Installing and removing the Microsoft Outlook 365 add-in.
The add-in's user interface varies depending on whether you are using it in a web browser, a desktop application, or a mobile application. Typically, if you activate the add-in, Outlook shows a side-panel with instructions and controls for giving feedback.
For example, when you activate the Coro add-in in the Outlook for mac desktop application, Outlook loads the add-in as a side panel:
To reduce duplicate reports, Coro prevents users from reporting emails that are already in the default quarantine folder.
To report emails as phishing:
Select one or more emails.
Select Coro from the toolbar.
Windows:
macOS:
Outlook 365 opens the Coro add-in side panel.
Select REPORT PHISHING:
Outlook 365 displays a Marked as phishing notification above each selected email:
Coro moves reported emails to your default email quarantine folder and processes the user report.
To report emails as safe:
Select one or more emails from your default email quarantine folder.
Select Coro from the toolbar.
Windows:
macOS:
Outlook 365 opens the Coro add-in side panel.
Select Mark As Safe:
Outlook 365 displays a Marked As safe notification above each selected email:
Coro moves affected emails from your default email quarantine folder back to your inbox and processes the user report.
To learn about installing or removing the Coro add-in for Gmail, see Installing and removing the Gmail add-in.
The appearance and layout of the interface depends on whether you are using the add-in in a web interface or a mobile application. Typically, if you activate the add-in, Gmail shows a side-panel with instructions and controls for giving feedback.
For example, when you activate the Coro add-in from Gmail in a browser, Gmail loads the add-in as a side panel:
To report emails as phishing:
Select one or more email messages.
Select Coro for Gmail from the sidebar:
Gmail opens the Coro add-in side panel.
Select Report Phishing:
Coro displays a confirmation dialog and labels all affected emails according to your default email quarantine folder:
ImportantIf your default email quarantine folder is set to Dedicated 'Suspected' folder, Coro assigns the Suspected label to the email.
If your default email quarantine folder is set to System trash folder, Coro assigns the Bin label to the email.
To report emails as safe:
Select one or more emails that Coro has labeled according to your default email quarantine folder.
Select Coro for Gmail from the sidebar:
Gmail opens the Coro add-in side panel.
Select Mark As Safe:
Coro displays a confirmation dialog and reapplies the Inbox label to all affected emails:
Coro processes a user report based on whether or not a ticket was already raised against that email. In other words, Coro might have identified the email as containing malicious content and already raised a ticket in the console before the user report is received.
Equally, in some cases, Coro might receive a user report for an email that does not meet the threshold for suspicious content, and thus no ticket has been raised.
If Coro has already raised a ticket, the outcome of the user report also depends on whether that ticket has been automatically remediated and closed, or remains open for admin user review.
The following table summarizes each scenario and the action Coro takes:
| Ticket raised and open | Ticket closed after review | No ticket raised | |
|---|---|---|---|
| Reported as Safe | The ticket is marked with feedback from the user report. | The ticket is marked with feedback from the user report and re-opened for operator review. | No action. |
| Reported as Phishing | The ticket is marked with feedback from the user report. | The ticket is marked with feedback from the user report. | Coro creates a new ticket of type Reported by user. For more information, see Email Security ticket types. |
In the Ticket Log, Coro marks tickets affected by a user report with phishing or safe:
