Go to Threat Resolution > Incidents to view, take action on (remediate), and manage incidents in PhishTitan.

Incidents are divided into two groups, which can be accessed by selecting either the Action Needed or Resolved tabs at the top of the page.

  • The Action Needed tab opens by default when you select Threat Resolution > Incidents and displays incidents requiring admin attention. These are Incidents that have been reported by users using the TitanHQ for Outlook add-in. When you mark these mails as safe or move them to junk, they are automatically moved to the Resolved tab.

  • Select the Resolved tab to see mails that have been automatically flagged by the system and ones that you have taken action on. No further action is required for these incidents.

  • Use the search search-incidents.jpg box to search the list of incidents.

  • Select the column column-icon.jpg icon to display the table column names. Slide each on and off to view or hide a column. The following columns are available:

    • Date: The date the reported email was received.

    • Subject: Email subject line of the reported email.

    • Sender: Sender email address of the reported email.

    • Flag Reason: The reason this email was flagged for further investigation. See Incident Flag Reasons.

    • Recipients: The number of users that received this email on the customer tenant.

    • Status: The current status of this incident. See Incident Status Descriptions.

    • Customer: The PhishTitan customer this incident is related to.

    • Actions: Actions available for this incident. Select the view view-icon-small.jpg icon to go the the Incident Summary page. If you believe an email to be clean, you can select the allow sender PT-Allow-List-Icon.jpg icon to add it to the customer Allow List.

  • To view additional details of an incident, go to the Actions column and select the view view-icon-small.jpg icon for the incident. The Incident Summary page will display.

  • To add a sender to the Allow List, go to the Actions column and select the allow sender PT-Allow-List-Icon.jpg icon for the incident. See Allow List for further details.

Incident Flag Reasons

Flag Reason

Description

User Reported Phishing

A user reported this email as phishing with the TitanHQ for Outlook add-in.

User Reported Clean

A user reported this email as clean with the TitanHQ for Outlook add-in.

Suspicious Text

PhishTitan detected suspicious text in the body of this email.

Malicious Links

PhishTitan detected malicious links in the body of this email.

Incident Status Descriptions