Cybersecurity Analyst how-to
How to Triage a Reported Phishing Email
Fast, consistent phishing triage stops attacks before they spread.
Fast, consistent phishing triage stops attacks before they spread. In short: thank; check; analyze, then complete the remaining steps below.
Step by step
Thank the reporter and collect the original email with full headers.
Check the sender, reply-to address and authentication results (SPF, DKIM, DMARC).
Analyze links and attachments in a safe, isolated environment or with approved tools.
Determine if it’s malicious, spam or legitimate.
If malicious, search for and remove similar messages and block indicators.
Check whether anyone clicked or entered credentials; reset passwords and review sign-ins if so.
Document the incident and share awareness tips if appropriate.
Safety reminders for cybersecurity analysts
- Act only within your authorization and organizational policy
- Handle evidence carefully and preserve chain of custody
- Protect sensitive data you encounter during investigations
- Follow legal and regulatory notification requirements
Key terms
SOC · SIEM · EDR · IOC · Phishing · Ransomware: see the full cybersecurity analyst glossary.