Phishing & Suspicious Email Triage
Median analyst time per report < 3 min
Employees report suspicious emails. Security triages each one manually: is it phishing? malware? just spam? Every triage is 5-10 minutes of security-analyst time. When reports scale — and they always do — either the queue grows or the analyst becomes automatic ("yeah probably fine") and misses the real one.
An hour-by-hour walkthrough.
Step by step.
- 01
Ingest reported email
Email forwards to [email protected]. Sig extracts headers, sender, subject, body, links, attachments. All processed in isolated sandbox — nothing executes in your environment.
Email gateway · Slack integration - 02
Sandbox links + attachments
Every URL clicked in an isolated browser (URL sandbox); every attachment opened in an isolated VM (attachment sandbox). Malicious behaviour observed: credential harvesting, malware download, exfiltration.
URL sandbox · Attachment sandbox · Threat intel - 03
Classify
Classification model + threat-intel enrichment: phishing (harvest credentials), malware (executable payload), BEC (business email compromise / wire fraud), spam (annoying but harmless), legitimate (falsely reported).
LLM · Threat intel APIs - 04
If malicious: quarantine + hunt
Quarantine the reported email from every mailbox that received it. Hunt for related messages (same sender, similar subject, similar template). Auto-quarantine the related ones. Notify affected recipients.
Email platform · Slack - 05
Analyst review
Security analyst reviews Sig's classification + actions taken. Rare misclassifications get corrected + fed back for future accuracy. Common patterns become detection rules.
Slack · Security dashboard
What you connect to make this run.
Google Workspace · Microsoft 365
read+writeEmail API with read + quarantine scopes. Read reported emails; quarantine originals + related messages from affected mailboxes.
URL sandbox (urlscan.io · VirusTotal · custom)
readExternal sandbox APIs. URLs submitted, verdict returned within seconds. No traffic ever touches your production environment.
Attachment sandbox (Joe Sandbox · Any.Run · custom)
readAttachments detonated in isolated VMs. Behavioural report returned; findings correlated with threat intel.
Threat intel (VirusTotal · abuse.ch · commercial feeds)
readIOCs from the email checked against known-bad indicators. Enrichment improves classification confidence.
Before and after, honestly.
Playbooks that pair with this one.
Compromised Credential Response
When someone clicked through before the email was quarantined, this playbook fires.
Security Alert Triage & Context
Same enrichment + classification pattern for other alert types.
Compliance Training
Employees who fell for the phish get targeted awareness training assigned.
IOC Enrichment & Lookup
Post-incident: IOCs from the phish feed the enrichment library for future detection.
Answers about this playbook.
What if the phishing is targeted (spear-phishing, not mass)?
Same flow. Sig quarantines the reported email + hunts for related; even single-recipient spear-phishing gets analyst attention within minutes. Detection is not sensitive to campaign size.
What about business-email-compromise (BEC) — email that looks like it's from the CEO?
Classification includes BEC detection: sender-domain analysis (lookalike domains flagged), tone analysis (urgency + wire-transfer request), and cross-check against actual sender via DKIM. High-confidence BEC gets escalated immediately.
Can we integrate with our SEG (secure email gateway)?
Yes — SEG detections feed Sig as high-confidence signals. Sig complements the SEG by handling the human-reported cases the SEG missed. Analysts see both feeds unified.
What if the reported email turns out to be legitimate?
Sig classifies as legitimate + closes the report with a note to the reporter. Feedback loop: consistent false-positive senders get whitelisted; analyst can retrain the classifier on the mis-classification.
Does this violate email privacy?
Only quarantines emails that were reported by recipients OR match a high-confidence threat pattern. Never reads employee mailboxes at will. Full audit trail of every quarantine action.
See it run on your data.
Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.