Loading…
Phishing Incident Response Playbook - decision trees, enrichment tools, query templates, and escalation criteria across 9 investigation phases.
Initial assessment of the reported email. Review the subject, sender, urgency cues, and any embedded threats. Classify into category and assign severity.
// Identify phishing emails by common indicators
EmailEvents
| where Timestamp > ago(24h)
| where SenderMailFromDomain != "yourdomain.com"
| where ThreatTypes has "Phish"
| project Timestamp, RecipientEmailAddress, SenderMailFromAddress,
Subject, ThreatTypes, DetectionMethods// Suspicious email detection in Splunk index=email sourcetype=mail | eval subject_lower=lower(Subject) | where match(subject_lower, "(urgent|password|verify|account|invoice|payment)") | stats count by from_addr, subject, recipient