Phishing Triage

What this capability handles

How it works in detail.

Phishing Triage solves the gap between a reported phish and a decision on it. Reported messages pile up in the reporting channel, real threats sit next to false alarms, and without fast triage a live campaign can spread before anyone acts. This capability triages every reported item quickly and decides whether to contain, dismiss, or escalate, so genuine threats are contained early and noise is cleared without tying up the analyst. It is for security operations teams that ask staff to report suspicious email and need consistent, fast follow-through. It works in order. First it intakes the reported phish from the reporting channel. Then it analyses the artifact, examining headers, URLs, and payloads against your threat intelligence, prior triage, and containment playbook. Next it decides the action: contain, dismiss, or escalate. For items it contains, it orchestrates the containment actions, and it logs every step. Per report it produces a decision with the signals behind it and, where warranted, executed containment actions. The decision logic is rule-based: it applies artifact-analysis rules and threat-intel signals to decide contain, dismiss, or escalate, so each report is judged on evidence rather than guesswork. The logic is conservative on anything that looks serious. Confirmed incidents, targeted-campaign patterns, and executive-target phish route to the analyst for immediate ownership rather than being handled automatically. Clear-cut dismissals and routine containments are actioned and logged; anything that signals a real or coordinated threat is escalated to a person fast. Every action is logged and reviewable, so the team has a complete record of what was reported, what was decided, and what was contained. It fits teams with the EDR feed connected, the email gateway integrated, and the containment playbook approved. Where those are in place, reported phish gets a fast, consistent verdict. Phishing Triage carries 25-35% of the role's volume and drives 25-35% of its impact, measured as phishing-triage lead time with containment discipline. The target is lead time under 15 minutes, so a reported phish moves from inbox to decision in minutes rather than hours, and a spreading campaign is caught while it still matters. Because every report runs through the same analysis and the serious cases always reach a human quickly, the team triages at speed without losing the judgment that real incidents demand.