Flow Designer Inbound Email Rule question

[EricG]

Not sure if this is the correct forum.

I have a request to check inbound emails for "Phishing" test emails being sent to the Help Desk.

Case:

User X gets a "Phishing Email Test" from our security department.

If user opens attachment or clicks link, they they fail the test and need to go to training.

If the click "Report Phishing" then they pass and all is well.

What we are finding is that users are either:

1. Using a third party system to validate OK - Not correct path and not my problem.

2. Reporting as Junk (mobile) - again not my issue.

3. Not opening or clicking link.  Sending to Report Phishing email address and including the Help Desk.  **this is what i need to solve for.

When #3 is done, Servicenow is basically opening the attachment or link and failing the user test case.  Which isn't wrong but is technically.

What i'm been asked to do is create rule to ignore these emails based on Subject Line which changes each month.

My thought is to use a custom table that stores this info and script a condition to ignore if match found.

Custom date field u_phish_test_subject = Know your evacuation plan!

is this possible to script?  and would the inbound flow fail for no match and continue to others?

Is there a way to make sure this is run first?

Any advise would help.

[EricG]

@nowgpt1 Thank you for the example.  I have this in Lower environment testing.

It appears to be working.  I'm hoping this will also solve the issue of the Phishing Test attachment not opening falsely and marking the user as "un-successful".   Will continue testing with my GRC group to validate.

Thanks again