TriageMTTR

Phishing Report Verdict

Pulls the reported message and headers, checks the mail gateway, and returns a verdict with the evidence attached.

Part of Phishing report triage

Tools

Microsoft Defender for Office 365, Microsoft Sentinel, Slack

Outcomes

Verdict within 30 minutes • Evidence attached to one case • Duplicate reports merged

Documentation

Instruction-ready detail below

When <in:email>a phishing report</in:email> lands, pull the original message and headers, check whether the gateway delivered it, and <slack>post</slack> a verdict of phish, credential harvest or benign with the evidence.

Instruction file

When <in:email>a phishing report</in:email> lands, pull the original message and headers, check whether the gateway delivered it, and <slack>post</slack> a verdict of phish, credential harvest or benign with the evidence.

Setup requirements

Tools

Microsoft Defender for Office 365, Microsoft Sentinel, Slack

Trigger

When an employee reports a suspicious email

Setup time

20 minutes

Other automations in this workflow

Account Takeover Hunt

Lists the mailbox rules and recent sign-ins for a user whose mail session was flagged as compromised.

Phish Campaign Hunt

Hunts the mail log for other deliveries of the same sender and link once a report is confirmed.

Proofpoint Phishing Triage

Classifies a reported message against a known threat campaign and opens one case for the campaign rather than the report.

Related workflows

Incident triage

Turns an incoming alert into one case with an owner, a severity and a first decision, so response starts while the detail is still arriving.

Log analysis

Converts a vague question about whether something happened into a scoped search with a written answer, its sources, and its limits.

Audit trails

Joins the scattered administrative change records into one timeline, so an auditor's question is a search rather than a fortnight of exports.

Download

Start with one instruction file.

Download the app and begin with drafts and checklists before you write anything back.

  • •Plain-language instructions
  • •Runs on your machine
  • •Works with your existing setup
  • •Reviewable activity history
Download