Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=Phish-Threat-campaign-results

Campaign results

You can see a summary of the user activities and filter them By User, By Group, or By Attack.

The By Attack view lists all the templates that are or were part of this campaign.

Go to My Products > Phish Threat > Campaigns and click a campaign.

For each user, time stamps are shown for the following events:

  • Email sent: When the user sent the campaign email.

  • Delivery Status: The current delivery status of the email. Hover on the status to see more details.

    • Pending: The email has been sent but the delivery status hasn't been received yet.
    • Delivered: The email was delivered successfully. Hovering on it shows the date and time of delivery.
    • Failed: The email wasn't delivered. Hovering on it shows the details of the delivery failure. When an email isn't delivered, the recipient mailbox is added to the Bounced Mailboxes list.
    • Blocklisted: The email delivery wasn't attempted because an email from a previous campaign wasn't delivered.

    For Failed and Blocklisted emails, you can review the errors in Settings > Bounced Mailboxes. See Bounced mailboxes.

    If you've fixed the delivery error, select these rows and resend the campaign email to the selected users. If the resend attempt is successful and the email is delivered, the recipient's email ID is automatically removed from the list.

    Note

    When a user is added to the bounced mailboxes due to failed delivery, you must address the problem before attempting to resend emails. If you don't, any future campaigns intended for this user won't be sent.

  • Email opened: When the user opened the email.

  • Reported Email: When the user reported the email as a phishing email.
  • Clicked link: When the user clicked the phishing link in the email.
  • Entered Credentials: When the user entered credentials that were requested by the email in a Credential Harvesting campaign.
  • Started training: When the user began the required training course.
  • Finished training: When the user successfully passed the quiz at the end of the required training.

For each group, the numbers of users are shown for each of the above events instead of timestamps.

To clear a user's events from the campaign results, click Clear campaign events Clear campaign events icon.. This action clears everything except Email sent events, and is recorded in the Audit Log.