Phishing Incident v3

Email Attachments

Case Basic Details

Incident Files

Indicators

Email HTML Image

URL Screenshots

Related Phishing Campaign

Work Plan

Response action

Email Delete Result

Linked Incidents

Selected indicators to block

Indicators selected to be blocked.

Email Body

:warning: This section contains the original HTML of the email. Links may lead to malicious websites!

Incident SLAs

Email Headers

Headers extracted from the original email.

Headers Analysis

Analysis of SPF, DKIM, DMARC and Microsoft anti-spam headers. For Microsoft anti-spam headers, please click on each item for the relevant documentation: [PCL](https://docs.microsoft.com/en-us/exchange/antispam-and-antimalware/antispam-protection/antispam-stamps?view=exchserver-2019) - Phishing Confidence Level. [BCL](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/bulk-complaint-level-values?view=o365-worldwide) - Bulk Complaint Level. [SCL](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/spam-confidence-levels?view=o365-worldwide) - Spam Confidence Level. `Note`: The default value is 0, but it can be changed when the "Process Microsoft's Email Headers" playbook runs.

ML Prediction For The Email

Results of machine-learning checks on the email using a pretrained model.

Email Type Information

The category of the email. In case of a phishing email, also shows the phishing sub-type.

Raw Email HTML

Spear Phishing Investigation

ML Prediction for URLs

Provides machine-learning based detection of phishing URLs (shows only malicious detections).

Macro Source Code

In case a macro code was found in any of the attachments, the source code will appear here.

Malicious Clicked URLs information

In case there were URLs in the email with a score of 3 or above which the user clicked for the email investigated in this incident, they will appear in the **Clicked URLs** table. **Total Malicious URLs Clicks** represents the number of clicks in all emails (other emails as well) associated with any of the malicious URLs found in this email. **Malicious URL Viewed** will be **True** if the click was allowed or the user clicked through, in case it was blocked.

Threat Intelligence Analysis