Security operations · Phishing investigation
Every inbox a sensor. Every report answered.
When an employee spots a suspicious email, two things should happen fast: someone works out whether it is real, and if it is, it disappears from every other inbox that got it. Phishing Investigation gives your employees a Report Phish button, and gives you a team and an analysis engine that do both.
Seven steps, and a person decides the one that matters
- 01
Report
The employee clicks Report Phish in Outlook, desktop or web, or in Gmail. If it was one of our simulations they are credited immediately and nothing else happens.
- 02
Group
Reports of the same email from different people are grouped by sender, subject, body, links or attachments, so twenty reports become one incident rather than twenty tickets.
- 03
Rules first
YARA rules, both built-in and your own, tag known patterns straight away: account-takeover lures, spam, marketing mail.
- 04
Analyze
Links, addresses, domains and attachments are checked against several threat-intelligence sources, including VirusTotal, MetaDefender, Spamhaus and AlienVault OTX, alongside our own engine and SpamAssassin. Headers are examined — SPF, DKIM, DMARC, the Received chain, and the reputation of the sending domain and mail server. The result is a single risk score.
- 05
Decide
An analyst reviews the evidence and classifies the email as phishing, spam, clean or unknown. Clear-cut cases are handled by playbooks automatically; a person makes the call on the rest.
- 06
Remove
The verdict is applied across every mailbox that received the email: find, delete, quarantine, move to spam, hide its links, or label it with a warning.
- 07
Tell the reporter
The person who reported it is told what happened, in their own language — including anyone who reports the same email later.
Your analysts, or ours
Both run on the same console. What differs is who works the queue when something is reported.
Both include
- A phishing report button in every inbox, on desktop, web and mobile
- Automatic analysis of each report: headers, links, attachments and sender reputation
- Removal from every mailbox that received the message
- Platform training and support for your administrators
Investigation Platform
For teams with their own security operations, who want the tooling and keep the judgement in house.
- Your analysts work the queue in the investigation console
- Your team decides what is real, and what gets removed
- Your own playbooks and SOAR targets
Managed Investigation
For teams without a security operations function of their own, who want reported mail handled rather than queued.
- Our analysts work the queue for you
- We decide, remove it, and tell you what it was
- You keep the console, and read the result rather than work it
One case, not a thread of forwarded mail
Sender analysis
The sender, the sending domain and the mail server, each with reputation.
Header analysis
The full delivery path, server by server, with the authentication results.
Links and attachments
Each one with its own verdict, and the evidence behind the verdict.
Content
The rendered message, its images, and the original message file.
Reporters
Who reported it and when, with VIP flags for executives and other high-risk roles.
History and comments
Every action taken, by whom, and why.
Machines do the repetitive part
Playbooks
Act on their own when conditions are met — a known-bad sender, a threat-intelligence verdict, a risk score above your threshold — to reclassify, prioritize, notify, remove or escalate.
Proactive mailbox hunt
When one report reveals a campaign, we search mailboxes for the same email even where nobody reported it, and act on what we find.
Push to your controls
Malicious domains, addresses, URLs and file hashes can be sent into your security stack and your SOAR workflow to log or to block, with an expiry date. Trend Micro Apex One and Apex Central, FortiMail and pfSense are supported, with an approval step before anything is enforced.
Into your SIEM
Incidents and actions can be forwarded over Syslog, in summary or in detail.
Awareness teaches people to spot phishing. This makes spotting it worth something.
The two share a single Report Phish button. A report of a simulated email raises that employee’s reporting score in the awareness platform; a report of a real email goes to investigation. The employee does not have to know which is which, and should not have to.
Phishing Investigation is a separate service. It works alongside either awareness option, or entirely on its own.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
If it was one of our simulations, they are credited for it and it raises their reporting score — which is the behavior the whole program is trying to produce. If it was a real email, it goes into the investigation platform: rule-based checks first, then the links and attachments against a set of reputation sources, then the headers — SPF, DKIM, DMARC, the Received chain — and the reputation of the sending domain and mail server. A person makes the final call, and the resulting action is applied across every mailbox that received it: find, delete, quarantine, or move. The person who reported it is told what happened, in their own language.
Because the checks take time, and the ones that take time are the ones worth having. Threat-intelligence lookups, rule matching and any automatic actions all have to finish before a case is complete, and it is marked complete when they are.
Clear-cut cases close automatically through playbooks. The rest wait for an analyst, which is deliberate rather than a backlog.
They are looking at different data, and at different times. The same URL can be clean in one source, unknown in a second and malicious in a third, and that is most common in the first hours of a new campaign — exactly when a report matters most.
It is why the result is combined into a single risk score rather than presented as a row of verdicts, and why anything that is not clear-cut is reviewed by a person.
An app registration with admin consent, including tenant-wide mailbox read and write.
That is a significant permission and worth understanding rather than approving: it is what allows a phishing email to be found and removed from every inbox that received it, not just from the inbox of the person who reported it. Without it, the service can analyze a report but cannot act on the result. We walk your security team through the full permission list before anything is granted.
No. Investigation works on its own: the Report Phish button, the analysis and the removal do not depend on running simulations, and some clients buy only this.
Together they reinforce each other, though, and visibly so — people report far more when reporting has been seen to lead somewhere.
Where to go next
Integrations & security
Entra ID, LDAP, Microsoft 365 delivery and forwarding to your SIEM.
Managed Detection & Response
Round-the-clock monitoring, for when a click becomes an incident.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.