Triage workflow for a reported suspicious email

Intake and preservation

Obtain the original as an .eml or .msg attachment rather than a forward, which loses headers. Record who reported it, when, and whether they clicked, opened an attachment, or replied. Hash the file and store it in a case folder so later steps work from a known copy.

sha256sum report-2026-1102-01.eml
mkdir -p cases/2026-1102-01 && cp report-2026-1102-01.eml cases/2026-1102-01/

Analyze without detonating

Review the trusted Received hop and Authentication-Results, compare the From, Reply-To, and Return-Path domains, extract URLs and attachment hashes, and check them against threat intelligence and your proxy logs. Never open links or attachments on your workstation; use an isolated analysis VM or a sandbox service your organization approves.

• Headers: trusted hop, authentication, domain mismatches
• URLs: extract, defang, check reputation
• Attachments: hash and check; analyze only in isolation
• Body: urgency, payment changes, credential prompts

Lab: triage a training sample

Use a phishing sample from a training corpus or one generated by your organization’s simulation platform. Work through the steps and fill in the triage note. Then search your mail platform for other recipients using the sender address, subject, or a URL, which in Microsoft 365 is a Content Search or Threat Explorer query, and in Google Workspace the security investigation tool.

case 2026-1102-01
reporter: a.rivera  clicked: no  replied: no
from: payroll@examp1e-hr.example  reply-to: hr-desk@freemail.example
auth: spf=pass dkim=pass dmarc=pass (lookalike domain, registered 3 days ago)
urls: hxxps://examp1e-hr[.]example/login  reputation: newly registered, credential form
attachments: none
recipients found: 37
verdict: credential phishing
actions: purge from 37 mailboxes; block domain and URL; notify recipients

Remediate and close

Remove the message from all mailboxes, block the sender domain and URLs at the gateway and proxy, and check proxy or DNS logs for anyone who visited the link. If credentials may have been entered, reset them, revoke sessions, and review sign-in logs. Tell the reporter the outcome; feedback keeps people reporting.