TriageMTTR

Phish Campaign Hunt

Hunts the mail log for other deliveries of the same sender and link once a report is confirmed.

Part of Phishing report triage

Tools

Microsoft Sentinel, Microsoft Defender for Office 365, Jira Service Management

Outcomes

Delivered copies found • Purge list prepared for approval • Clicked accounts flagged

Documentation

Instruction-ready detail below

Once <in:databases>the mail log</in:databases> confirms a phish, search for other delivered copies by sender and link target, then <jira>open a ticket</jira> with the purge list and every account that clicked.

Instruction file

Once <in:databases>the mail log</in:databases> confirms a phish, search for other delivered copies by sender and link target, then <jira>open a ticket</jira> with the purge list and every account that clicked.

Setup requirements

Tools

Microsoft Sentinel, Microsoft Defender for Office 365, Jira Service Management

Trigger

When a reported message is confirmed as phishing

Setup time

30 minutes

Other automations in this workflow

Account Takeover Hunt

Lists the mailbox rules and recent sign-ins for a user whose mail session was flagged as compromised.

Phishing Report Verdict

Pulls the reported message and headers, checks the mail gateway, and returns a verdict with the evidence attached.

Proofpoint Phishing Triage

Classifies a reported message against a known threat campaign and opens one case for the campaign rather than the report.

Related workflows

Incident triage

Turns an incoming alert into one case with an owner, a severity and a first decision, so response starts while the detail is still arriving.

Log analysis

Converts a vague question about whether something happened into a scoped search with a written answer, its sources, and its limits.

Audit trails

Joins the scattered administrative change records into one timeline, so an auditor's question is a search rather than a fortnight of exports.

Download

Start with one instruction file.

Download the app and begin with drafts and checklists before you write anything back.

  • •Plain-language instructions
  • •Runs on your machine
  • •Works with your existing setup
  • •Reviewable activity history
Download