All playbooks
SOC · SOC analysts, email security and incident responders
Advanced phishing and campaign triage
Preserve message evidence, scope campaign delivery, trace user impact and verify approved remediation.
Preserve the original message and delivery record together. A forwarded screenshot or stripped copy can lose headers and identifiers needed to scope the campaign.
What this does not establish
- A spoofed display name or failed email authentication does not prove delivery or mailbox compromise.
- A click or QR scan does not establish credential submission, token theft or MFA bypass.
- A single report does not show the whole campaign or every recipient.
0 of 12 ticked
Selected step
FrameStep 1 of 12
Secure the original message and classify the lure before drawing conclusions.
Preserve raw message and delivery evidence
- Store the RFC 822 message or trusted mail-platform export in the approved evidence location.
- Keep Message-ID, envelope sender, Reply-To, recipients, UTC times and delivery state.