FREE COURSE / SELF-PACED LEARNING

Phishing Email Triage: From Message Evidence to Containment

Learn safe email handling, SPF, DKIM, DMARC, exposure scoping and evidence-led dispositions in this free phishing triage course.

Read the first lesson Explore the curriculum

Read freely. Create an account to save your completed lessons.

Experience level
Intermediate
Curriculum
3 modules · 6 lessons
Estimated reading
18 min
Language
English

Reading estimates use lesson text and an allowance for diagrams. Reflection, exercises and optional linked resources take additional time. These are estimates, not measured completion times.

KNOW WHAT YOU’RE WORKING TOWARD

What you’ll learn

  • Preserve and inspect a suspicious message without activating links, attachments, or remote content.
  • Interpret routing, identity, SPF, DKIM, and DMARC evidence without confusing authentication with harmlessness.
  • Evaluate URLs and attachments using controlled analysis boundaries and corroborating evidence.
  • Scope recipients and interactions, select a defensible disposition, and document proportionate containment.

Is this the right course for you?

Who it’s for

Analysts learning to investigate suspicious messages and explain a defensible disposition.

Scope and boundaries

Guided email-evidence reasoning. Do not activate suspicious links or attachments; interactive phishing scenarios are available separately in Missions.

How you’ll learn

Self-paced reading with explanatory diagrams and linked resources. Reflection and optional resource study take additional time.

Before you begin

  • Basic email and security operations familiarity — Learners should recognize common email fields and understand that security tools produce signals that require analyst interpretation. Administrative access to a mail platform is helpful but not required.

About this course

Built for service-desk responders, SOC analysts, and security generalists who handle suspicious messages, this course teaches a repeatable investigation that starts with preserved evidence and ends with proportionate action. Learners examine sender identities, Received fields, SPF, DKIM, DMARC, URLs, attachments, delivery scope, and user interaction without treating any single signal as a verdict. The course emphasizes safe handling, evidence limits, escalation boundaries, and concise case notes. Completion means the learner can triage a reported message, explain what the evidence proves and does not prove, identify affected recipients and interactions, and recommend containment without live-clicking attacker content or overstating confidence.

FOLLOW THE LEARNING PATH

Course curriculum

MODULE 1

1. Preserve and Read the Message

Build a safe evidence-first workflow, then learn to separate user-visible claims from transport evidence recorded by mail systems.

  1. Start with Safe Handling and an Investigation QuestionTurn a user report into a bounded investigation while preserving the original message and avoiding attacker-controlled interactions.3 min reading
  2. Reconstruct Routing and Sender IdentitiesRead Received fields from the first trusted mail boundary and compare visible, envelope, return, and signing identities.3 min reading

MODULE 2

2. Authenticate and Analyze the Content

Interpret domain authentication as scoped evidence, then examine destinations and files without turning analysis into execution.

  1. Interpret SPF, DKIM, DMARC, and AlignmentUse Authentication-Results correctly and avoid treating a pass or failure as a complete message verdict.3 min reading
  2. Analyze URLs, Redirects, and Landing EvidenceParse destinations, expand the investigation through approved passive evidence, and distinguish suspicious appearance from observed behavior.3 min reading

MODULE 3

3. Scope, Decide, and Contain

Handle attachments as potentially active evidence, expand the investigation to affected people and systems, and close with a reviewable decision.

  1. Triage Attachments Without Turning Analysis into ExecutionIdentify file type, preserve hashes and metadata, and escalate active-content analysis into an isolated environment.3 min reading
  2. Scope Exposure, Choose a Disposition, and Write the CaseFind related delivery and interaction, distinguish message risk from incident impact, and record evidence-linked containment.3 min reading

TAKE THE NEXT DECISION

Practise with a mission

Missions are separate interactive investigations. Review the campaign’s scope and access requirements before starting.

First Signal Operation Borrowed Trust Operation False Current Operation Last Light The Lantern Protocol

BUILD ON THE RIGHT FOUNDATION

These courses address different scopes. Choose the foundation or follow-on that fits your next question.

Beginner

Social Engineering: Break the Script

Request verification and safe reporting. The technical phishing triage course focuses on investigating message evidence.

6 lessons · 24 min estimated reading

Sources and editorial review

Reviewed by Threat Intelligence Lab

Sources linked in the lessons provide context and further reading. Check the original documentation for current platform behavior and requirements.

Selected references are shown here; the lessons contain the full reading lists.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.