opened
glennzw
username_0
I added the ability to display reported non-campaign emails on top of my [recent IMAP improvements](https://github.com/gophish/gophish/pull/1791). Any emails emails forwarded to your IMAP account that are not from gophish, and therefore require further investigation, would appear here. The emails are imported into the gophish db, as opposed to just being fetched on the fly and displayed. This is what it looks like:

![Screenshot 2020-05-30 at 19 48 41](https://user-images.githubusercontent.com/3966613/83336835-966daa00-a2ae-11ea-8e5f-3f62fa277abd.png)


Attachments can be viewed via the dropdown:

![Screenshot 2020-05-30 at 19 39 15](https://user-images.githubusercontent.com/3966613/83336686-44785480-a2ad-11ea-9aed-adef7a1bebe5.png)

The user can set the 'Status' of an email after evaluating it:

![Screenshot 2020-05-30 at 19 39 57](https://user-images.githubusercontent.com/3966613/83336694-5ce86f00-a2ad-11ea-9674-51a9cd999a7c.png)

...as well as adding manual notes:

![Screenshot 2020-05-30 at 19 41 14](https://user-images.githubusercontent.com/3966613/83336710-8b664a00-a2ad-11ea-9740-7f142bc62301.png)

The view icon loads the email, giving the option of viewing plaintext or HTML renderings (HTML rendered inside a sandboxed iframe):

![Screenshot 2020-05-30 at 19 41 48](https://user-images.githubusercontent.com/3966613/83336723-b6509e00-a2ad-11ea-8554-0f098c73ea26.png)



I've had quite a few requests for this feature. Do others find it useful? Any other feature requests? I'm thinking of adding support to automatically triage emails via open source feeds / APIs. I think it'd probably make more sense to de-couple that out of gophish, and have another standalone application that queries emails via the API and updates notes / status on detected threats (rather than rolling in the tooling into gophish itself).

I'll also add a toggle button to enable/disable this functionality in the settings, as well toggling the display of the 'Reported Emails' menu item.
Display of reported non-campaign emails (request for comment)
issue
created
jordan-wright
username_1
Hey @username_0!

Thanks for sending this in. I really like this! It looks really similar to what I built with isthislegit. https://github.com/duo-labs/isthislegit

I’m personally just fine integrating this into Gophish. While it’s tangential to the core function, I think it adds significant value and making part of the single binary would be really nice.

Want to make a PR and we can start working through it?
comment
created
glennzw
username_0
Oh, great minds think alike! I hadn't seen isThisLegit, it looks great. My work almost seems superfluous now but yeah hopefully will still be of use in gophish :)

My new stuff is built on top of the new IMAP library which hasn't merged into master yet - shall I wait for that merge, then I can send a pull request on top of that?
comment
created
jordan-wright
username_1
Let's go ahead and make this a separate pull request if possible (as in, you can make this a separate branch so you can do a separate PR). You can post in now, and we'll work to merge the IMAP stuff first. That will update the diff so we only see the new stuff.

But, posting it now can help me get an idea of how you're thinking about getting this implemented and we can chat through options.
comment
closed
glennzw
username_0
issue
created
glennzw
username_0
Closing, as I've made a pull request now https://github.com/gophish/gophish/pull/1894
comment