My work computer is quite locked down (can't even install Solitaire or Minesweeper), so I'll have to set up whatever filter in Outlook. And I think it deletes the messages once flagged as phishing, so I don't think I have one to inspect right now.

Anyway, some random blog seems to point back to KnowBe4's whitelisting guide, so I think the filter would need to look for something in the header or for the specified IP addresses?