← Phishing Email Triage: From Message Evidence to Containment
1. Preserve and Read the Message
Start with Safe Handling and an Investigation Question Reconstruct Routing and Sender Identities
2. Authenticate and Analyze the Content
Interpret SPF, DKIM, DMARC, and Alignment Analyze URLs, Redirects, and Landing Evidence
3. Scope, Decide, and Contain
Triage Attachments Without Turning Analysis into Execution Scope Exposure, Choose a Disposition, and Write the Case
1. Preserve and Read the Message

Start with Safe Handling and an Investigation Question

Turn a user report into a bounded investigation while preserving the original message and avoiding attacker-controlled interactions.

In this lesson, you will learn to:

  • Create a minimum evidence package for a reported message.
  • State a triage question and define actions that require escalation or an isolated environment.

Start with Safe Handling and an Investigation Question

Explains the minimum evidence package, safe handling boundaries, and the difference between confirming a suspicious message and scoping a security incident.

Preserve first, then inspect

A screenshot is useful context, but it is not the original message. It omits routing fields, authentication results, exact URLs, attachment hashes, and message identifiers. Preserve the message in the mail platform or export it in the organization-approved format. Record the reporting user, mailbox, receipt time, subject, sender as displayed, Internet Message-ID, current delivery location, and any action the user reports taking. Use the platform copy for analysis so forwarding does not add new headers or alter the body.

Do not click, reply, unsubscribe, load remote images, or open an attachment on the analyst workstation. Those actions can confirm a live address, contact attacker infrastructure, or execute active content. Preview panes and security products differ, so follow the local handling procedure rather than assuming a view is inert. Preserve timestamps in their original time zone and normalize a working copy to UTC only when building a timeline. The result of this step is a traceable evidence item, not yet a malicious verdict.

Preserve the message before analysis changes itThe evidence path retains the original message, metadata, user report, and a separate analyst working copy.FIELD GUIDEPreserve the message before analysis changes itOriginal messageRaw headersUser reportAnalyst working copyEVIDENCE LAYERS
Preserve the message before analysis changes it — The evidence path retains the original message, metadata, user report, and a separate analyst working copy.

Frame the question and the safety boundary

Write the investigation question before collecting more data: “Was this message delivered by an unauthorized sender, did any recipient interact, and what action is required now?” This prevents an attractive clue from expanding the case without purpose. Separate three decisions: message disposition, exposure scope, and incident severity. A message can be malicious with no user interaction; a user can interact with a benign but unwanted message; and a compromised account can send content that authenticates correctly.

Define the safety boundary explicitly. Header parsing and mail-platform searches are ordinary triage. Resolving a domain through approved passive services may be allowed. Visiting a destination, submitting confidential content to a public service, detonating a file, resetting an account, or deleting mail across many inboxes may require a controlled system or additional authority. Record what is unavailable. Missing body content, retention gaps, or a deleted attachment reduces confidence; it does not justify filling gaps with assumptions.

Safe triage stops at defined trust boundariesRoutine inspection stays separate from live interaction, detonation, account action, and enterprise-wide deletion.FIELD GUIDESafe triage stops at defined trust boundariesTRUST BOUNDARYHeader parsing •Mailbox searchLive destination •Detonation andcontainmentTRUST BOUNDARY
Safe triage stops at defined trust boundaries — Routine inspection stays separate from live interaction, detonation, account action, and enterprise-wide deletion.

Resources

Next: Reconstruct Routing and Sender Identities →