Seven reports, three messages
Triage a phishing-report mailbox with grep, sort, and uniq. Group reports by original sender, find the campaign most people reported, and close the ones that are genuine.
Briefing
When many people report the same message, it is one incident, not many. Grouping by sender and subject tells you where to spend time first.
Each report in the queue carries the original From, Subject, and Authentication-Results as headers.
mail-triage · Email and phishing
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.