← All Tools
IR Flow · interactive playbook
Phishing Investigation
Triage a suspicious message: pull the indicators out of the URL and the raw headers, read the authentication verdict, defang for the ticket, map the technique, and export the case as CSV / STIX 2.1 for your TIP or as an after-action note.
Playbooks: Phishing Investigation Ransomware Response
⚠ Educational guidance only, not a certified procedure.
Follow your organisation's incident response plan and reporting obligations. Nothing you enter here leaves your browser. The case lives in memory only unless you tick "Keep this case in my browser"; closing the tab wipes it.