Phishing Layout

Alert Details

Notes

Work Plan

Indicators

Timeline Information

Closing Information

Blocked Indicators

Indicators that the user selected to block, when blocking is done in manual (default) mode.

Email Information

Attachment Information

Information about attachments extracted from the reported email.

Attachments

All file attachments of the email, and the email file itself if it was attached or retrieved.

Alert Scope

Email & URL Screenshots

Email HTML

:warning: This section contains the original HTML of the email. Links may lead to malicious websites!

Action Center

If executed, the email corresponding to the Message ID below will be deleted from the mailbox of the user specified below.

Email Delete Result

Raw Email HTML

Email Headers

Header Analysis

Analysis of SPF, DKIM, DMARC and Microsoft anti-spam headers. For Microsoft anti-spam headers, please click on each item for the relevant documentation: [PCL](https://docs.microsoft.com/en-us/exchange/antispam-and-antimalware/antispam-protection/antispam-stamps?view=exchserver-2019) - Phishing Confidence Level. [BCL](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/bulk-complaint-level-values?view=o365-worldwide) - Bulk Complaint Level. [SCL](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/spam-confidence-levels?view=o365-worldwide) - Spam Confidence Level. `Note`: The default value is 0, but it can be changed when the "Process Microsoft's Email Headers" playbook runs.

Threat Intelligence Analysis

Macro Source Code

Malicious URL Clicks

Requires the **Microsoft 365 Defender** integration.

Investigation Insights