[Tadrill] Checking Training Results – HENNGE One Help Center

Target Audience

Administrators of Tadrill

Purpose

This document explains the procedure to check training results.

Notes

The content of this article is based on the product details as of March 2026. It may change without notice due to updates or specification changes.
Administrator privileges for Tadrill are required to verify actual screens or change settings.
Please refer to the following article for how to access the administration console.
[Tadrill] How to Log in to the Administration Console
Customers with the HENNGE One Basic plan cannot view the [Summary] screen under [Training].

Procedure

Access [Training] from the left menu of the Tadrill administration console.
Select the training for which you want to check the results from the list screen.
The training details screen will be displayed, so select the tab for the item you want to check.

Checking Targets and Activities

You can check the training history from the [Targets and Activities] tab.

How to Check Activities by User

From the [User List] tab, you can check whether each user opened the email, performed risky actions, and the number of reports.
※ You can search for users using the Search Filters.
※ The export function downloads all users regardless of the Search Filters conditions.
By clicking on a user, you can check the action log for the target user, such as the date and time of URL clicks or reports.
※ For details on each item in the displayed training summary and action log, please refer to "Items (Targets and Activities)".

How to Check the Action List

From the [Action List] tab, you can check the information of users who performed each action.
For actions suspected to be performed by bots, Tadrill automatically assigns the [Suspected Bot Operation] status.
※ The system's automatic judgment is provided to assist manual responses by administrators.
We continuously adjust the detection of mechanical action patterns to improve detection accuracy.
However, due to the many irregular patterns, it is difficult to automatically detect all mechanical actions.
Please manually verify and respond in conjunction with the system's automatic judgment.
If bot operation is suspected for each action, you can set the [Bot Operation] status for the target action.
Actions recorded as bot operations are not counted as risky actions in the summary tables and graphs.
For detailed procedures, please refer to the article below.
[Tadrill] Changing the Status of Training Results

Summary

You can check information such as the total number of emails opened, the number of reports, and the number of risky actions related to the conducted training on the dashboard.

Open the [Summary] tab and check the contents of the displayed dashboard.
For details on each displayed item, please refer to "Items (Summary)".

Items (Targets and Activities)

Name	Description
Email Open	Number of times the training email was opened Note: If "Track email opens" was disabled during training creation, the value will be displayed as a hyphen (-).
Risk Action	Number of times dangerous actions were performed from training emails Insert phishing URL in the mail body: Access to the URL Attachment: Open the attachment (Preview is not counted) Insert link to download malware macro file in the mail body: Download the attachment For details, please refer to the following page. [Tadrill] What are dangerous actions in training?
Report	Number of times the training email was reported to the administrator using Tadrill Alert (suspicious email reporting feature)
Sent at	Delivery date of the training email
Training Email	Configured training name
Action	Content of the performed action Email Opened: Opened the email URL Click: Accessed the phishing link in the training email Download Link Click: Accessed the download link in the training email Attachment Click: Opened the attachment in the training email Report: Reported the training email to the administrator using Tadrill Alert (suspicious email reporting feature)
IP Address	IP address from which the action was performed
User Agent	Information about the device or OS from which the action was performed
Datetime	Date the action was performed

Items (Summary)

Name	Description	Notes
Overview	Total number of emails opened, reports, and risky actions for the conducted training	-
Risk Distribution	Risk distribution based on user actions for the conducted training	-
Details	Actions by user attributes for the conducted training	By Department: Displays actions performed by each user by department for the conducted training. By Position: Displays actions performed by each user by position for the conducted training.

Items (User List CSV)

Display Name	CSV Field Name	Description
User	email	Email address
-	first_name	Given name
-	last_name	Family name
User attributes	department	Department
User attributes	position	Title
-	group_user	Whether to treat this user as a group TRUE FALSE
Training email	template_name	Name of the training email set
Email sent at	email_sent_at	Sent date of the training email
-	latest_email_open	Last opened date and time of the email
-	latest_clicked_link	Last date and time the phishing link in the training email was accessed
-	latest_downloaded_file	Last date and time the download link in the training email was accessed
-	latest_activated_file	Last date and time the attachment in the training email was opened
-	latest_report	Last date and time the training email was reported to the admin using Tadrill Alert (suspicious email reporting feature)
Email open	email_open_count	The number of times the phishing link in the training email was accessed
Risk action	click_count	The number of times risk actions were performed from the training email Phishing link: Accessing the URL Attachment: Opening the attachment (preview is not counted) Download link: Downloading the attachment
Reports	report_count	The number of times the training email was reported to the admin using Tadrill Alert (suspicious email reporting feature)
-	user_tags	Tags assigned to the user

Items (Action List CSV)

Display Name	CSV Field Name	Description
User	email	Email address
-	first_name	Given name
-	last_name	Family name
Action	action	Details of the action performed Email opened: The email was opened URL clicked: Accessed the phishing link in the training email Download link clicked: Accessed the download link in the training email Attachment clicked: Opened the attachment in the training email Report: Reported the training email to the admin using Tadrill Alert (suspicious email reporting feature)
IP address	ip_address	The source IP address from which the action was performed
User agent	user_agent	Device or OS information from which the action was performed
Datetime	time_of_action	The date the action was performed
-	bot_like	Status automatically assigned by Tadrill TRUE: Bot-like exists FALSE: Bot-like doesn't exist
-	admin_judgement	Status manually assigned by the admin Unspecified: Not assigned User: Marked as user action Bot: Marked as bot action

Reviewing the Training

Please refer to page 18 and beyond of the following material to review the conducted training.
Tadrill Utilization Guide

Tadrill 参考資料.pdf
400 KB Download
Tadrill Utilization Guide.pdf
300 KB Download