How To Delete Recipient Actions

Occasionally within the Phishing Tackle platform, you may see false positives reported against a recipient. These could include attachment or email opens from odd locations or multiple link clicks within an email which didn't occur.

In most cases these are caused by a allowlisting issue, especially with additional protection such as Microsoft Advanced Threat Protection (ATP) or Google Caching.

If you are sure that the actions recorded against a recipient are false, they can be deleted in two different ways, both listed below.

Deleting recipient actions from the account summary page

1. Click "Campaigns" under the "PHISHING" heading on the side menu.
   
   
2. Find the relevant campaign you wish to delete the recipient action from and click the title to go to the campaign actions page.
   
   
3. Click the "Total Recipients" Doughnut chart.
   
   
4. Find the relevant recipient and click any of the RED failure numbers to the right of their details 
   • NOTE; Clicking the green "Delivered" number will take you to the "Delivered emails" page
     • Clicking on any red number will show you ALL failure results for that user, not just those from the column selected, this is done intentionally as seeing all actions in a timeline order makes it simpler to discover mailbox compromises.
       
       
5. Find the action you wish to delete and hit the Trashcan icon on the right.
   
   
6. Hit "DELETE".

This will remove the action entirely from every area of the Phishing Tackle platform and cannot be undone. 

Deleting recipient actions from the map

1. Click "Campaigns" under the "PHISHING" heading on the side menu.
   
   
   
2. Find the relevant campaign you wish to delete the recipient action from and click the title to go to the campaign actions page.
   
   
3. Scroll down until you see the IP address location map.
   
   
4. Click the country which contains the erroneous action.
   • NOTE; Click the country, not the colourful blob representing the clicker.
     
     
5. Find the action you wish to delete and hit the Trashcan icon on the right.

This will remove the action entirely from every area of the Phishing Tackle platform and cannot be undone. 

Either of these methods can be used to delete individual or multiple actions but as mentioned before, be especially vigilant to confirm the mailbox is not compromised before assuming it to be a false positive.

That's all there is to it! Enjoy using the Phishing Tackle platform and if you have any questions please don't hesitate to contact our support desk who will be happy to help.