Lets you choose whether reported real emails are saved in the SIEM Inbox for review, or only forwarded to the configured notification email.
Ensures the report event is always recorded in the campaign, even when the SIEM Inbox is not active.
Guarantees the .eml file is always delivered to the configured email address, regardless of the toggle's state.
Differentiates SPAM-movement behavior by email client (Google Workspace vs. Microsoft Outlook), unaffected by the toggle.
Navigation: Settings → Report Button
In the Report Button settings section you will find:
The Emails field where you enter the addresses that will receive report notifications.
The "Save Reported Emails on SIEM Inbox" toggle.
What does this toggle do?
Enabled: reported emails are stored in the platform's SIEM Inbox and immediately forwarded to the configured notification email.
Disabled: reported emails are not stored in the SIEM Inbox. Only the
.emlis forwarded to the configured email.
Full behavior by email client:
Google Workspace (Gmail)
Action | Toggle disabled | Toggle enabled |
|---|---|---|
Real email → SIEM Inbox | ❌ Not saved | ✅ Saved |
Real email → move to SPAM | ❌ Not moved | ❌ Not moved |
| ✅ Always | ✅ Always |
Campaign email → "reported" event | ✅ Always | ✅ Always |
Campaign email → move to SPAM | ❌ Not moved | ❌ Not moved |
Microsoft Outlook
Action | Toggle disabled | Toggle enabled |
|---|---|---|
Real email → SIEM Inbox | ❌ Not saved | ✅ Saved |
Real email → move to SPAM | ✅ Always | ✅ Always |
| ✅ Always | ✅ Always |
Campaign email → "reported" event | ✅ Always | ✅ Always |
Campaign email → move to SPAM | ❌ Not moved | ❌ Not moved |
Client difference: in Microsoft Outlook, real emails are always moved to SPAM when reported, regardless of the toggle's state. In Google Workspace, this never happens.
Campaign emails (simulations) are never moved to SPAM in any client or configuration.
If the toggle is disabled, does the report event disappear from the campaign?
No. The "reported" event is always recorded in the campaign if the email was a simulation, regardless of the toggle's state.
Is the .eml only sent if the toggle is enabled?
No. The .eml is always delivered to the configured email address, whether the toggle is on or off.
What's the difference between having the toggle enabled or disabled?
With the toggle enabled, the reported email is saved in the SIEM Inbox and also forwarded to the configured email. With the toggle disabled, the email is not saved in the SIEM — only the .eml is forwarded.
Why does a real email in Outlook get moved to SPAM even when the toggle is disabled?
Moving to SPAM in Outlook is an email client behavior, not a toggle behavior. The toggle only affects whether the reported email is saved in the SIEM Inbox.
Can simulation emails end up in SPAM?
No. Campaign emails are never moved to SPAM in any client or configuration.
Have feedback or want to request improvements? Let us know at roadmap.whalemate.com/roadmap
