Emails reported as Phishing not creating Alerts or Incidents

[Edmund_Fearon]

Hi all,

From what I have read I am expecting the marking of emails as Phishing using the Report message add-in in Outlook should result in an Alert generating in XDR based on the default "Email reported by user as malware or phish" policy, but this is not happening in my tenant. Alerts for junk email are getting created, along with Incidents.

Some assistance identifying whey Alerts are not generating for emails reported as phishing would be much appreciated.

[#2]

@Edmund_Fearon 

Hey, alerts for this are default policy. Go to "Policies & Rules" under Email and Collaboration and choose 'Alert Policy', from here make sure the "Email reported by user as malware or phish" rule is enabled.

[#3]

@keenanbrooks 

I've seen the same behavior in the past week. Our default alert is enabled and correct. It hasn't been modified in 7+ months.

We receive *some* email notifications stating an email was reported. There haven't been any incidents created for reported phishing emails since 2/2.

[#4]

Hi Keenan, the policy is set to enabled.

[#5]

Hey everyone,

Having the same issue that is described in the original post. The Alert Policy is enabled, but still no Alerts nor Incidents are created.