1. Expel Help Center
  2. Expel Managed Phishing
  3. Get Started With Managed Phishing

Gmail Report Phishing Button Set Up

This article guides you through the process of configuring a phishing button for Gmail.

Note
Read/write mail access is required for our analysts to quarantine and remediate on your behalf.

Prerequisites

  1. ​You must be a Google Workspace domain super admin to complete this process.
  2. ​You must first download the necessary file in Workbench, as you will need its contents to complete the setup.
    • Go to Organization Settings > Your Organizations > scroll down to the Phishing tab.
    • Look for the file called GmailAddOn.zip.

Quick Start

  1. Create a Google Workspace Add-on Project
  2. Create a Google Workspace Cloud Project
  3. Connect Google Workspace Cloud and Add-on Projects
  4. Install Add-on to Domain

Step 1: Create a Google Workspace Add-on Project

  1. Navigate to https://script.google.com/ and login as the domain super admin.

  2. Select New project.

    mceclip4.png

  3. Select Untitled project, rename the project Report potential phishing, and then select Rename.

    mceclip5.png

  4. Select the plus sign (+) next to Files, and then select Script.

    mceclip6.png

  5. Enter Config as the file name and press Enter.

    The following example shows the file list:

    mceclip7.png

  6. At the bottom of the navigation bar, select the Settings icon.

    mceclip0.png

  7. Select the Show "appscript.json" manifest file in editor checkbox.

    mceclip10.png

  8. In the navigation bar, select the Code Editor icon.

    mceclip11.png

    The appscript.json file appears in the file list like the example below:

    mceclip1.png

  9. Using the provided GmailAddOn.zip file, extract, copy, and paste the contents of each file into the corresponding files in the Apps Script editor.

    • Before

      mceclip2.png

    • After

      mceclip3.png

  10. After the files are copied into and saved in the Apps Script editor, select Deploy and select New deployment.

    mceclip4.png

  11. Select the gear icon next to Select type, and then select Web app and Add-on.

    mceclip16.png
  12. On the Configuration pane, do the following:
    • In the New description field, enter Report potential phishing.
    • In the Who has access field, select the Anyone within… option.

    • Select Deploy.

      mceclip17.png

  13. After the deployment is complete, under Deployment ID, select Copy, and then save the ID for use in a later step.

    Note

    Keep this tab open. You return to it in a later step.

    mceclip18.png

Step 2: Create a Google Workspace Cloud Project

  1. In a new browser tab, navigate to https://console.cloud.google.com/projectcreate.

  2. Enter Report potential phishing as the project name, and then select CREATE.

    mceclip19.png

  3. From the menu on the left, select APIs & Services > Enabled APIs & services.

    GmailPhishingButton_Step_2-2.png

  4. Search for Google Workspace Marketplace SDK.

    mceclip22.png

  5. From the search results, select Google Workspace Marketplace SDK.

    mceclip23.png

  6. Select ENABLE.

    mceclip24.png

  7. Select the App Configuration tab.

    GmailPhishingButton_Step_2-7.png

  8. From the App Configuration tab, select The OAuth Consent Screen must be enabled for this project.

    mceclip26.png

  9. On the OAuth consent screen, select Internal, and then select CREATE.

    mceclip27.png

  10. Complete the following fields, leaving the rest empty: 

    • App name: Report potential phishing
    • User support email: enter an email address for the security team/help desk where end users can direct general questions if they have any
    • Developer contact information: support@expel.com
  11. Select SAVE AND CONTINUE.

  12. On the Edit app registration page, select ADD OR REMOVE SCOPES.

    mceclip28.png

  13. In the Update selected scopes area that opens, copy the following scopes into the Manually add scopes field.

    • https://www.googleapis.com/auth/gmail.addons.execute
    • https://www.googleapis.com/auth/gmail.addons.current.message.readonly

    • https://www.googleapis.com/auth/gmail.send

      mceclip29.png

  14. Select ADD TO TABLE.

    mceclip30.png

  15. Verify that the following scopes are added to the table and chosen, and then select UPDATE.

    mceclip31.png

  16. The Edit app registration page appears, showing the 3 scopes. Scroll to the bottom of the page and select SAVE AND CONTINUE.

    mceclip32.png

Step 3: Connect Google Workspace Cloud and Add-on Projects

  1. Navigate to https://console.cloud.google.com/apis/api/appsmarket-component.googleapis.com/googleapps_sdk.

  2. Copy the App ID.

    mceclip33.png
  3. Return to the Apps Script tab, or navigate to the Report potential phishing project at https://script.google.com.

  4. Navigate to Project Settings, and then, at the bottom of the page, select Change project.

    mceclip34.png

  5. Paste the copied App ID from Step 3.1 into the GCP Project Number field, and then select Set project.

    mceclip35.png
  6. Go back to the API & Services cloud console tab https://console.cloud.google.com/apis/api/appsmarket-component.googleapis.com/googleapps_sdk, and then do the following:
    • Select the Google Workspace Add-on checkbox.
    • Select the Deploy using Apps Script deployment id checkbox.

    • Enter the Deployment ID copied from Step 1.

      mceclip37.png

  7. In the OAuth Scopes section, select ADD SCOPE, and then add the 3 scopes below. 

    As a result, the list includes five scopes, including two defaults:

    mceclip38.png

  8. Select the following options:
    • In Installation Settings, select Admin Only Install.
    • In App Visibility, select Private.
    • Select SAVE.
  9. Scroll to Developer Links and enter the following:

  10. Select the Store Listing tab in the middle of the page.

    GmailPhishingButton_Step_3-8.png
  11. Under App Details, Next to English, select the down arrow.
  12. Fill in the following App Details fields:
    • Application Name: Report potential phishing
    • Short Description: Report potential phishing emails

    • Detailed Description: Utility to help send potential phishing emails for triage

      mceclip42.png
  13. select DONE.
  14. Fill in the following remaining fields:
    • Category: Administration and Management
    • Graphic Assets (select BROWSE and upload image from zip file):
      • Application Icon 32x32: 32x32.png
      • Application Icon 128x128: 128x128.png
      • Application Card Banner: 128x128.png
    • Screenshot (select BROWSE and upload image from zip file): 80x80.png

    • Support Links:

    • Distribution: select All Regions or select from the Regions list.

      GmailPhishingButton_Step_3-10.png
  15. Select PUBLISH.

Step 4: Install Add-on to Domain

  1. Navigate to https://gsuite.google.com/marketplace/mydomainapps.

  2. Select the Report potential phishing app, and then select Domain Install.

    mceclip3.png

  3. In the Domain wide install area, select CONTINUE.

    mceclip2.png

  4. On the OAuth Consent Screen, agree to the terms of service, and then select ALLOW.

    mceclip1.png

  5. In the success message window, select DONE.

    mceclip0.png

    The add-on becomes available to end users shortly. It can take as long as 24 hours for the deployment to take effect.

Related articles