---
title: "KnowBe4"
slug: "knowbe4"
updated: 2026-02-13T16:22:45Z
published: 2026-02-13T16:30:10Z
canonical: "docs.hunters.ai/knowbe4"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# KnowBe4

Self Service Ingestion

          

Connect this data source on your own, using the Hunters platform.

****TL;DR****

|  | Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| KnowBe4 PhishER Logs |  | ✅ | ✅ | ✅ | knowbe4_phisher_logs |  | NDJSON | WE |

---

## Overview

Check Point Harmony Email & Collaboration (formerly Avanan) is an API-based![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/knowbe4.png) email and collaboration security platform that connects directly to Microsoft 365, Google Workspace, and tools like Teams, OneDrive, and SharePoint to stop phishing, BEC, malware, and data loss before messages reach inboxes or files are shared. It analyzes content, links, and behavior using Check Point ThreatCloud intelligence and ML to detect zero-day threats, account takeover, graymail, and shadow IT. Deployment is lightweight (no MX change), policy-driven, and covers inbound, outbound, and internal email plus collaboration flows.

## Supported data types

### KnowBe4 PhishER logs

**Table name:** `knowbe4_phisher_logs`

KnowBe4 **PhishER Logs** capture user-reported suspicious emails (via the Phish Alert Button), recording metadata like sender, subject, headers, and timestamps. They let security teams triage real threats vs. training, feed SIEMs for correlation, and improve user risk scoring and incident response.

Useful for auditing, campaign analysis, and reducing time-to-remediate phishing incidents.

Learn more [here](https://support.knowbe4.com/hc/en-us/articles/14196559482387-Create-and-Manage-Webhooks-in-Your-PhishER-Platform).

## Send data to Hunters

Hunters supports the ingestion of KnowBe4 logs via Webhook.

**To connect KnowBe4 logs:**

1. 1. Log in to your PhishER platform.
2. 2. Navigate to **Settings** > **Webhook**.
3. 3. Click the **New Webhook** button in the top-right corner of the page to open the **Add Webhook Settings** pop-up window.
4. 4. In the **Add Webhook Settings** pop-up window that opens, configure your webhook settings. To learn more about these settings, see the screenshot and list below:

![Create Webhook page](https://helpimg.s3.amazonaws.com/PhishER/Webhooks/PhishER_Create_Webhook_Page.png)
  1. **Name:** In this field, enter a custom name for your webhook.
  2. **URL:** In this field, enter the URL that you are trying to callback to. For a list of URL rewriters and shorteners that are compatible with PhishER, see our [PhishER FAQ](https://support.knowbe4.com/hc/en-us/articles/360014171474#UNWINDING) article.
  3. **Authorization:** From the drop-down menu, select one of the following protocols: **No Auth**, **API Key**, **Bearer Token**, or **Basic Auth**.
  4. **Available Data:** Select one or more types of data that you would like to send to the webhook.

**Note:**The **Addresses** data type sends all email addresses in the webhook payload, including the email addresses in the **From**, **To**, **CC**, **Reply To**, and **Reported By** fields.
  5. **Custom Data**: To add custom data to your webhook’s payload, click the **plus sign** icon. Then, fill out the **key** and **value** fields. For example, if your application requires "{ "System" : "PhishER" }" in the payload to receive data, you could enter "System" and "PhishER".
  6. **Custom Headers**: If you would like to add a custom header, click the **plus sign** icon. Then, fill out the **key** and **value** fields. For example, if your firewall requires the "{ "Header" : "PhishER" }” header to allow data to pass through, you could enter "Header" and "PhishER".
  7. **Message Tags**: In this section, you can select the **Success** or **Failure** check boxes if you would like PhishER to assign a tag when the webhook is used to send data. Then, enter a tag name in the field next to the selected check box.
5. Click **Create**.

## Expected format

Logs are expected in JSON format.

```json
{ "receivedAt":"2019-05-20T17:39:43.351851Z", "reportedAt":"2019-05-20T17:39:39Z", "sender":"sender@example.com", "reporter":"reporter@example.com", "subject":"JSON Syslog Example", "priority":"medium", "category":"spam", "status":"received", "action":"Action 1", "tags":"TagSet" "permalink":"[[Unique URL]]" }
```

```