Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=Phish-Threat-report-behavior

User Behavior report

The User Behavior report shows users' involvement in phishing campaigns.

Go to My Products > Phish Threat > Reports > User Behavior to review your users' response to your campaigns.

Behavior report filter

You can view a list of users using the following filters:

  • All users: All users enrolled in a simulated attack campaign.
  • Caught users: Users who were caught by a simulated attack campaign.
  • Repeat users: Users who were caught by a simulated attack campaign multiple times.
  • Reported threats: Users who reported threats on simulated attack campaigns.
  • Failed to report threats: Users who opened a simulated attack campaign email but didn't report it.
  • Entered credentials: Users who entered their credentials on a simulated attack campaign.
  • Opened attachments: Users who opened attachments on a simulated attack campaign.

Limit report data to a specific date range

You can limit the report data to a specific date range.

To limit the report data, do as follows:

  1. Click the date field.
  2. Select a date range and click Apply.

Creating campaigns from a report

You can create a new campaign with all the users from your report pre-enrolled.

Click Create campaign with these users to start a new campaign.

Export

Click Export to CSV to export the current view as a comma separated file.

Deleted users

Phish Threat reports data to Sophos Central every 30 days. If you delete a user who was enrolled in a campaign within the last 30 days, Phish Threat still includes that user in its usage reports to Sophos Central. As a result, Sophos Central detects the user's recent activity and automatically recreates the user in the system, even if you previously deleted them.

Before you delete a user, make sure you take the following actions:

  • Check if the user was enrolled in a phishing or training campaign in the last 30 days.

  • Wait 30 days from the user's last activity date.

    To know the date, go to Phish Threat > Reports > User Behavior > All enrolled > All users and filter the date to show the active users within the last 30 days. Click Export to CSV to see a spreadsheet of user activity and look for Last Targeted or Last Enrolled date.

After 30 days without activity from the user, you can permanently delete them, and they won't reappear on the Users & Groups page.