📚 Step 9 of Your Riot activation journey.
⬅️ Previous step: 8️⃣ Prepare your awareness programme
💡 Prerequisite: having completed the setup of your workspace (steps 1 to 6).
This step equips your employees' email with two complementary protections:
the report button (Inbox module): your employees report a suspicious email in one click, and you find it in Riot to deal with it;
malicious email detection (Slash): Riot analyses every incoming email to spot the attacks that get through Google's or Microsoft's filters. Depending on the mode you choose, it flags them to you, alerts the employee with a banner, or removes the email before they see it.
Start with the button: Slash is then installed from Inbox.
💡 Prerequisites:
Administrator access to Riot, and being signed in to hub.tryriot.com;
a plan that includes the Inbox module for the report button and Slash for detection;
access to your email admin console (Microsoft 365 or Google Workspace). If you don't have it, complete this step with your IT team.
❶ Install the report button
👉 Step 1: Open Inbox
In the left-hand column of your screen, under Apps, click Inbox.
👉 Step 2: Start the installation
Click Install the extension.
👉 Step 3: Deploy the button in your email system
Deployment is done in your email admin console. Follow the guide that matches yours:
Outlook (Microsoft 365): 3️⃣ How to install it? On Outlook (Riot button)
Gmail (Google Workspace): 2️⃣ How to install it? On Gmail
On Outlook, you choose who receives the button: everyone, certain users or groups, or just you for a first test.
👍 Good to know: on Outlook, the button can take up to 24 hours to appear, although it is usually much quicker. If it doesn't appear in the Outlook app after a restart, check in Outlook on the web.
To understand what happens next when an employee reports an email: Understanding Inbox.
❷ Enable the detection banners (Slash)
💡 Prerequisite: the report button is installed (❶), and your employees are synced from Google or Microsoft (step 1). Slash must also be enabled for your workspace: if the Slash section doesn't appear in the Inbox settings, contact your Riot Account Manager or our team via the chat.
👉 Step 1: Turn on Slash
In Inbox, open Settings, then the Slash section. Turn on the Slash switch and follow the instructions shown on screen.
👉 Step 2: Choose the protection mode
On the same page, choose what Slash does with a detected email. You can change it at any time.
Warning: an alert banner appears in every dangerous or suspicious email. Nothing is blocked: your employees see the email and the warning. This is the detection banner mode.
Auto-remediation: malicious emails are removed from the inbox, so the employee never sees them. Emails that only call for caution keep their banner. See Slash: Auto-remediation mode.
Audit only, no action: Slash analyses everything but displays nothing and moves nothing. You see in Inbox what it would have detected. See Slash: Audit mode.
💡 Our recommendation: haven't introduced Riot to your employees yet (step 11)? Start in Audit mode: it changes nothing for them and shows you what Slash detects. Switch to Warning mode once your employees have been informed.
👉 Step 3: Grant Slash its permissions
Slash needs to read emails (to analyse them) and to modify them (to add banners or remove malicious emails). The procedure depends on your email system and is done in its admin console: follow part ❹ of 2️⃣ How to install detection banners (Slash).
👉 Step 4: Confirm the installation
Riot sends an email to the administrator who started the installation. Open it and click Verify configuration. If the check succeeds, Slash immediately starts analysing incoming emails.
👍 Good to know: whatever the mode, every email detected by Slash automatically appears in Inbox, without waiting for an employee to report it.
❸ Strengthen the protection (recommended)
👉 Neutralise an attack across the whole organisation (Block threat)
In Inbox, open Settings, then Security actions, and turn on Block threat. As soon as a reported email is confirmed as malicious, all emails from the same attack are removed from your employees' inboxes, and any further ones are removed as soon as they arrive.
👉 Check internal impersonation (optional)
In the Slash settings, the Auto Impersonation Protection option lets Riot automatically contact an employee whose identity seems to have been spoofed, to check that they really sent the email. Riot contacts them on the channel chosen at step 4.
🛠️ A problem?
The button doesn't appear in Outlook: see How to resolve troubleshooting Inbox on Outlook ?
The Slash section doesn't appear in the Inbox settings: contact your Riot Account Manager.
Still stuck? Contact our team via the chat in the platform.
Key takeaways
First install the report button from the Inbox menu, then deploy it in your email system by following the Outlook or Gmail guide.
Then turn on Slash in the Inbox settings, and grant it permissions on your email system.
Banners appear in Warning mode; Audit mode lets you test without changing anything for your employees.
Turn on Block threat to neutralise an attack across the whole organisation from a single report.
📚 Ready for the next step?