Phishing Email Triage: From Message Evidence to Containment
About this course
Built for service-desk responders, SOC analysts, and security generalists who handle suspicious messages, this course teaches a repeatable investigation that starts with preserved evidence and ends with proportionate action. Learners examine sender identities, Received fields, SPF, DKIM, DMARC, URLs, attachments, delivery scope, and user interaction without treating any single signal as a verdict. The course emphasizes safe handling, evidence limits, escalation boundaries, and concise case notes. Completion means the learner can triage a reported message, explain what the evidence proves and does not prove, identify affected recipients and interactions, and recommend containment without live-clicking attacker content or overstating confidence.
What you'll learn
- ✓ Preserve and inspect a suspicious message without activating links, attachments, or remote content.
- ✓ Interpret routing, identity, SPF, DKIM, and DMARC evidence without confusing authentication with harmlessness.
- ✓ Evaluate URLs and attachments using controlled analysis boundaries and corroborating evidence.
- ✓ Scope recipients and interactions, select a defensible disposition, and document proportionate containment.
Course Content
Module 1: 1. Preserve and Read the Message
Build a safe evidence-first workflow, then learn to separate user-visible claims from transport evidence recorded by mail systems.
Start with Safe Handling and an Investigation Question
Turn a user report into a bounded investigation while preserving the original message and avoiding attacker-controlled interactions.
Reconstruct Routing and Sender Identities
Read Received fields from the first trusted mail boundary and compare visible, envelope, return, and signing identities.
Module 2: 2. Authenticate and Analyze the Content
Interpret domain authentication as scoped evidence, then examine destinations and files without turning analysis into execution.
Interpret SPF, DKIM, DMARC, and Alignment
Use Authentication-Results correctly and avoid treating a pass or failure as a complete message verdict.
Analyze URLs, Redirects, and Landing Evidence
Parse destinations, expand the investigation through approved passive evidence, and distinguish suspicious appearance from observed behavior.
Module 3: 3. Scope, Decide, and Contain
Handle attachments as potentially active evidence, expand the investigation to affected people and systems, and close with a reviewable decision.
Triage Attachments Without Turning Analysis into Execution
Identify file type, preserve hashes and metadata, and escalate active-content analysis into an isolated environment.
Scope Exposure, Choose a Disposition, and Write the Case
Find related delivery and interaction, distinguish message risk from incident impact, and record evidence-linked containment.