Skip to main content

Cloud-delivered Incident ResponderIncident Responder Documentation

Phishing Playbook Template

Break down the logic flow of the out-of-the-box phishing playbook template.

The phishing playbook template in the playbook interface.

Phishing emails imitate reputable senders to fool recipients into installing malicious software or revealing personal information.

The phishing playbook sources emails ingested into Case Manager. It checks the reputation of the domain that sent the email; extracts any files, URLs, or links; and checks the reputation of these entities. Then, the playbook checks if the email recipient has any web activity related to the URL.Email Ingest

Based on the sender's email address, the playbook searches for other recipients. If it finds other recipients, the playbook alerts you.