We handle phishing reports over email. The end user sends us the pertinent information, and our ticketing system takes the email and makes a ticket.

When it came to integrating Huntress SAT, we had to include our email in the Google group that was sent to our support and curricula phish reporting. All our clients send to this Google group, and it works really well.

The problem is that when the users report an email that is not a Huntress phish, we get a ticket from there request, and a ticket from Huntress letting us know that there was a report. The duplicate tickets are quite annoying, especially since the one from Hutnress is assigned to the catch-all organization.

I would like to see two options implemented:

For now, we will likely filter these, or alter our email ticket ingestion to create tickets from the Huntress notification, rather than the direct from user notification. We may also decide to dabble in the Curricula API, but native integrations are always preferred.