> ## Documentation Index
> Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cofense Triage integration setup

> Connect Cofense Triage to Living Security for employee-reported email and investigation outcomes.

export const EgressIpAllowlistBothSets = ({system}) => <Warning>
    <strong>{system} needs two sets of addresses, not one.</strong> Living Security mints this
    integration's access token on its own infrastructure and refreshes it continuously, so setup
    traffic and sync traffic leave from different networks. Allowlist both sets in {system}, and
    keep both in place — this is not a setup-only requirement.
    <br />
    <br />
    <strong>Integration sync traffic</strong> — the same in every region:
    <br />
    <code>52.34.139.153/32</code>, <code>54.69.127.183/32</code>, <code>44.247.133.183/32</code>,{' '}
    <code>52.26.211.56/32</code>
    <br />
    <br />
    <strong>Platform traffic</strong> — use only the row for the region that hosts your
    organization:
    <br />
    United States: <code>98.91.60.249/32</code>, <code>13.216.91.102/32</code>
    <br />
    European Union: <code>34.246.236.210/32</code>, <code>52.31.102.238/32</code>
    <br />
    <br />
    Allowlist only the sync set and setup never completes. Allowlist only the platform set and
    setup succeeds while every sync fails. See{' '}
    <a href="/integrations/managing/egress-ip-addresses">
      Configuring Integration Egress IP Addresses
    </a>{' '}
    for both failure signatures and the change policy.
  </Warning>;

export const PublicIntegrationNextSteps = () => <>
    <hr />
    <h2>Related resources</h2>
    <ul>
      <li>
        <a href="/signals/data-sources">Learn how integration data becomes Human Risk Management signals</a>
      </li>
      <li>
        <a href="https://www.livingsecurity.com/integrations">Explore Living Security integrations</a>
      </li>
      <li>
        <a href="https://app.livingsecurity.ai/">Open the Living Security Platform</a>
      </li>
      <li>
        <a href="https://www.livingsecurity.com/request-demo/">Request a Living Security demo</a>
      </li>
    </ul>
  </>;

export const ConnectInPlatform = ({tile, children}) => <Step title="Enter the credentials in the Living Security Platform">
    <p>
      Completed by whoever holds Living Security access — the program owner, or the system
      admin if they've been invited (delegated setup).
    </p>
    <ol>
      <li>
        Go to <strong>Settings → Integrations → Catalog</strong>, find the{' '}
        <strong>{tile}</strong> tile, click <strong>Connect</strong>.
      </li>
      <li>
        Fill in the fields below, then click <strong>Connect</strong>.
      </li>
    </ol>
    {children}
  </Step>;

export const SystemAdminBanner = ({system, recommendDelegated}) => <Note>
    <p>
      <strong>This guide is for your {system} administrator.</strong> It covers creating API
      credentials inside {system}, which requires admin access to {system} — not to the
      Living Security Platform.
    </p>
    <p>
      If you're the Living Security <strong>program owner</strong> and don't administer {system},
      send this page to whoever does. They complete Part A and hand the credentials back to you
      (or enter them directly if you've invited them into the platform).
      {recommendDelegated && <>
          {' '}Because setup produces sensitive key material, we recommend the{' '}
          <strong>delegated setup</strong> path so the secret is never sent back to you.
        </>}
    </p>
  </Note>;

<SystemAdminBanner system="Cofense Triage" recommendDelegated={true} />

## What this integration contributes

Cofense Triage can contribute normalized employee-reported email and investigation outcomes. Reviewed examples include:

* `phishing.real.reported` — reports real phishing emails
* `email.suspicious.reported` — reports suspicious emails
* `phishing.real.targeted` — targeted by real phishing campaigns

See [how integration data becomes signals](/signals/data-sources).

## What you need

Cofense Triage uses OAuth2 client credentials. Create an API application in your Triage tenant and copy its client ID and client secret. There is no browser consent step — you paste both values into Living Security and it requests the token itself.

## Setup

<Steps>
  <Step title="Create a dedicated Cofense credential">
    In Cofense Triage, create an API application that can read reports. Keep the credential limited to reporting access. Record the **client ID** and **client secret** — Triage shows the secret once.
  </Step>

  <Step title="Confirm the Triage hostname">
    Record your full tenant hostname, such as `acme.managedphishme.com` or the hostname assigned to your Cofense environment. Omit `https://` when entering it in Living Security.
  </Step>

  <ConnectInPlatform tile="Cofense Triage">
    Enter the **Client ID**, the **Client secret**, and the **Triage hostname**.
  </ConnectInPlatform>
</Steps>

## Verify and troubleshoot

Verify that the connection test can read the current user and reports before waiting for the first synchronization.

<AccordionGroup>
  <Accordion title="401 Unauthorized">
    Replace the client secret — it may have been rotated or revoked. Confirm that the hostname belongs to the same tenant that issued the credential.
  </Accordion>

  <Accordion title="403 Forbidden">
    The credential cannot read reports. Grant the minimum reporting permission required by your Cofense tenant, then reconnect.
  </Accordion>

  <Accordion title="The Triage hostname cannot be reached">
    If your Triage tenant restricts API access by source IP address, this integration needs **two** sets of addresses allowlisted. Living Security mints the access token itself and renews it continuously, so token requests and scheduled syncs leave from different networks — and on Triage they reach the same hostname.

    <EgressIpAllowlistBothSets system="Cofense Triage" />
  </Accordion>

  <Accordion title="Reports appear but reporters do not">
    Reporter enrichment is available only on connection variants that expose the reporter endpoint. Report-derived signals can still populate from supported report data.
  </Accordion>
</AccordionGroup>

<PublicIntegrationNextSteps />