The Incident Summary page shows all available details for an incident listed in PhishTitan > Incidents. When you select the incident you want to view in the Incidents table, the Incident Summary page appears as a slideout. You can move between incidents in the table and the Incident Summary page repopulates with the new data. You can select the fullscreen PT-pop-out-icon.jpg icon beside the Subject at the top of the page to expand it.

PT-Incident-Sum-Slideout.jpg

You can navigate the four tabs at the top to find more information about the incident.

PT-incidents-tabs.jpg

DETAILS

The Details tab is automatically displayed when the Incident Summary page opens. It includes the status, flag reason and content of the email. If the email was flagged as phishing or fraud, Reasons for Detection and URL Analysis sections appear below the Received Email section. All of these sections can be expanded and collapsed by selecting the up/down arrow.

PT-Reasons-for-Detection.jpg
  • Status

    Every incident is assigned a status

  • Flag Reason

    The following table explains reasons why an email can be flagged for further investigation.

    Flag Reason

    Description

    User Reported Phishing

    A user reported this email as phishing with the TitanHQ for Outlook add-in.

    User Reported Clean

    A user reported this email as clean with the TitanHQ for Outlook add-in.

    Suspicious Text

    PhishTitan detected suspicious text in the body of this email.

    Malicious Links

    PhishTitan detected malicious links in the body of this email. A malicious URL is a link embedded in an email that was created with the purpose of promoting scams, attacks, and frauds. When selected, malicious URLs can download ransomware, or lead to phishing or spearphishing emails.

    Phishing

    Spoofed Display Name

    Spam

    Fraud

  • Actions

    From the Actions menu, select an action to take on this incident.

    PT-Actions-Menu.jpg

    When you select one of the following actions for an email or domain, it is applied to all affected users. Select the Affected Users tab to see a list of all users that received the email.

    • Remediate: This action moves this email from a user's inbox to their Junk folder.

    • Mark as Safe: This action adds a green banner to this email marking it as safe. The email is delivered to the user's inbox.

    • Allow Sender: This action adds the sender to the Allow List. The email is delivered to the user's inbox without analysis. See Adding a Sender to the Allow List for additional information.

    • Allow Domain: This action adds the domain to the Allow List, so that any email using that domain is delivered to the user's inbox without analysis. See Adding a Domain to the Allow List for additional information.

  • Banners

THREAT COACH

AFFECTED USERS

The date and subject of the email are listed here, along with the email addresses of the recipient and sender. The name of the customer is also listed.

RECEIVED HEADERS

The content of the received header is displayed.