Phishing Campaign
Phishing Campaign Incident
Details
| ID | Phishing Campaign |
|---|---|
| Group | incident |
| Version | -1 |
| From Version | 6.0.0 |
Layout Structure
Legacy Summary 0 sections
No sections defined.
Campaign Overview 14 sections
Number of Campaign Incidents
Highest Severity
Senders
Campaign Duration
Mutual Campaign Indicators
Indicators that were detected in the phishing incidents of the campaign.
| Field ID | Position |
|---|---|
| campaignmutualindicators | Col 0-6, Height: 106 |
Campaign Canvas
| Field ID | Position |
|---|---|
| emailcampaigncanvas | Col 0-2, Height: 44 |
Campaign Snippet
A snippet from the latest incident, showing what the campaign email looks like. Meaningful phishing and spam words are in bold.
| Field ID | Position |
|---|---|
| emailcampaignsnippets | Col 0-4, Height: 106 |
Recipients
Owners
Information
The information displayed in the different sections updates dynamically. Changes are expected as incidents progress.
Similarity Range
Last incident occurred
Campaign Recipients
Campaign Senders
Campaign Management 3 sections
Campaign Incidents Info
The following incidents were detected as part of the same campaign by the FindEmailCampaign script. With default configuration - all similar incidents are also linked to the campaign, but you can always change this using the Incident Actions section below.
Incident Actions
Take actions on incidents that belong to the campaign.
| Field ID | Position |
|---|---|
| selectcampaignincidents | Col 0-2, Height: 53 |
| actionsoncampaignincidents | Col 0-2, Height: 53 |
| campaignclosenotes | Col 0-2, Height: 106 |
| — | Col 0-2, Height: 53 |
Notify Recipients
Send emails to the recipients involved in the incidents. Select specific incidents, or select "All", to automatically detect the relevant recipients.
| Field ID | Position |
|---|---|
| selectcampaignincidents | Col 0-4, Height: 22 |
| campaignemailto | Col 0-4, Height: 22 |
| campaignemailsubject | Col 0-4, Height: 22 |
| campaignemailbody | Col 0-4, Height: 44 |
| campaignemailsenderinstance | Col 0-2, Height: 22 |
| — | Col 1-3, Height: 44 |
Case Info 8 sections
Case Details
| Field ID | Position |
|---|---|
| type | Col 0-2, Height: 22 |
| severity | Col 0-2, Height: 22 |
| owner | Col 0-2, Height: 22 |
| sourcebrand | Col 0-2, Height: 22 |
| sourceinstance | Col 0-2, Height: 22 |
| playbookid | Col 0-2, Height: 22 |
Notes
Linked Incidents
Evidence
Team Members
Timeline Information
| Field ID | Position |
|---|---|
| occurred | Col 0-1, Height: 22 |
| dbotmodified | Col 0-1, Height: 22 |
| dbotduedate | Col 0-2, Height: 22 |
| dbotcreated | Col 1-2, Height: 22 |
| dbotclosed | Col 1-2, Height: 22 |
Closing Information
| Field ID | Position |
|---|---|
| dbotclosed | Col 0-2, Height: 22 |
| closereason | Col 0-2, Height: 22 |
| closenotes | Col 0-2, Height: 22 |
Note About Linked Incidents
Not all linked incidents may actually be related to the phishing campaign, and not all related incidents may be linked. This behavior customized via configuration of the Detect & Manage Phishing Campaigns playbook, or changed by the user through the Campaign Management tab under the Incident Actions section.
War Room 0 sections
No sections defined.
Work Plan 0 sections
No sections defined.
Evidence Board 0 sections
No sections defined.
Related Incidents 0 sections
No sections defined.
Canvas 0 sections
No sections defined.