Phishing Incident
Phishing Incident
Details
| ID | Phishing |
|---|---|
| Group | incident |
| Version | -1 |
| From Version | 6.0.0 |
Layout Structure
Case info 9 sections
Case Details
| Field ID | Position |
|---|---|
| type | Col 0-2, Height: 24 |
| severity | Col 0-2, Height: 24 |
| owner | Col 0-2, Height: 24 |
| dbotsource | Col 0-2, Height: 24 |
| sourceinstance | Col 0-2, Height: 24 |
| sourcebrand | Col 0-2, Height: 24 |
| playbookid | Col 0-2, Height: 24 |
Notes
Work Plan
Linked Incidents
Child Incidents
Evidence
Team Members
Timeline Information
| Field ID | Position |
|---|---|
| occurred | Col 0-2, Height: 24 |
| dbotcreated | Col 0-2, Height: 24 |
| dbotmodified | Col 0-2, Height: 24 |
| dbotclosed | Col 0-2, Height: 24 |
| remediationsla | Col 0-2, Height: 24 |
| dbotduedate | Col 0-2, Height: 24 |
| detectionsla | Col 0-2, Height: 24 |
Closing Information
| Field ID | Position |
|---|---|
| dbotclosed | Col 0-2, Height: 24 |
| closereason | Col 0-2, Height: 24 |
| closinguserid | Col 0-2, Height: 24 |
| closenotes | Col 0-2, Height: 48 |
Investigation 16 sections
Raw Email HTML
| Field ID | Position |
|---|---|
| emailhtml | Col 0-2, Height: 110 |
Email Text
| Field ID | Position |
|---|---|
| emailbody | Col 0-2, Height: 110 |
Email Basic Information
| Field ID | Position |
|---|---|
| emailfrom | Col 0-2, Height: 22 |
| emailto | Col 0-2, Height: 22 |
| emailsubject | Col 0-2, Height: 22 |
| emailcc | Col 0-2, Height: 22 |
| emailbcc | Col 0-2, Height: 22 |
| emailreplyto | Col 0-2, Height: 22 |
| emailreturnpath | Col 0-2, Height: 22 |
| emailmessageid | Col 0-2, Height: 22 |
| reporteremailaddress | Col 0-2, Height: 22 |
| emailsenderip | Col 0-2, Height: 22 |
| emailtocount | Col 0-2, Height: 22 |
Email Attachments
| Field ID | Position |
|---|---|
| attachment | Col 0-2, Height: 55 |
| attachmenthash | Col 0-2, Height: 24 |
| attachmentname | Col 0-2, Height: 24 |
| attachmentsize | Col 0-2, Height: 24 |
| attachmentextension | Col 0-2, Height: 24 |
| attachmenttype | Col 0-2, Height: 24 |
Incident Files
Indicators
Number of incidents per email address
Email HTML Image
Email Type Information
The category of the email. In case of a phishing email, also shows the phishing sub-type.
| Field ID | Position |
|---|---|
| phishingsubtype | Col 0-2, Height: 24 |
| emailclassification | Col 0-2, Height: 24 |
URL Screenshots
Email Authenticity Information
The result of SPF, DKIM and DMARC checks on the email.
| Field ID | Position |
|---|---|
| emailauthenticitycheck | Col 0-2, Height: 55 |
Critical Assets
Critical Assets that were found, at the investigation stage, to be involved in the incident.
| Field ID | Position |
|---|---|
| criticalassets | Col 0-2, Height: 110 |
Machine-learning Predictions
| Field ID | Position |
|---|---|
| dbotprediction | Col 0-2, Height: 24 |
| dbotpredictionprobability | Col 0-2, Height: 24 |
| dbottextsuggestionhighlighted | Col 0-2, Height: 24 |
Email Headers
Headers extracted from the original email.
| Field ID | Position |
|---|---|
| emailheaders | Col 0-6, Height: 106 |
Related Phishing Campaign
Microsoft Anti-Spam Headers
PCL - Phishing Confidence Level (4-8: The message content is likely to be phishing.) BCL - Bulk complaint level (4-7: The message is from a bulk sender that generates a mixed number of complaints. 8-9: The message is from a bulk sender that generates a high number of complaints.) SCL - Spam confidence level (5-6: Spam filtering marked the message as Spam. 9: Spam filtering marked the message as High confidence spam)
| Field ID | Position |
|---|---|
| phishingsclscore | Col 0-2, Height: 22 |
| phishingbclscore | Col 0-2, Height: 22 |
| phishingpclscore | Col 0-2, Height: 22 |
War Room 0 sections
No sections defined.
Work Plan 0 sections
No sections defined.
Evidence Board 0 sections
No sections defined.
Related Incidents 0 sections
No sections defined.
Canvas 0 sections
No sections defined.
Classic Summary 0 sections
No sections defined.