TriageMTTR

Proofpoint Phishing Triage

Classifies a reported message against a known threat campaign and opens one case for the campaign rather than the report.

Part of Phishing report triage

Tools

Proofpoint, Jira Service Management, Slack

Outcomes

One case per campaign • All recipients listed • Block request sent for approval

Documentation

Instruction-ready detail below

When <in:email>a submitted message</in:email> matches a known campaign, <jira>open one ticket</jira> listing every recipient, then <slack>ask</slack> an analyst to approve the campaign-wide block.

Instruction file

When <in:email>a submitted message</in:email> matches a known campaign, <jira>open one ticket</jira> listing every recipient, then <slack>ask</slack> an analyst to approve the campaign-wide block.

Setup requirements

Tools

Proofpoint, Jira Service Management, Slack

Trigger

When a submitted message matches a known threat campaign

Setup time

15 minutes

Other automations in this workflow

Account Takeover Hunt

Lists the mailbox rules and recent sign-ins for a user whose mail session was flagged as compromised.

Phish Campaign Hunt

Hunts the mail log for other deliveries of the same sender and link once a report is confirmed.

Phishing Report Verdict

Pulls the reported message and headers, checks the mail gateway, and returns a verdict with the evidence attached.

Related workflows

Incident triage

Turns an incoming alert into one case with an owner, a severity and a first decision, so response starts while the detail is still arriving.

Log analysis

Converts a vague question about whether something happened into a scoped search with a written answer, its sources, and its limits.

Audit trails

Joins the scattered administrative change records into one timeline, so an auditor's question is a search rather than a fortnight of exports.

Download

Start with one instruction file.

Download the app and begin with drafts and checklists before you write anything back.

  • •Plain-language instructions
  • •Runs on your machine
  • •Works with your existing setup
  • •Reviewable activity history
Download