Phishing reports
Receive reported emails, inspect them safely, extract observables and group near-identical mails into clusters.
Features
- Reported emails arrive with full headers, a sanitized body and a preview image.
- Links are defanged and observables extracted: URLs, domains, IP addresses, files and their hashes.
- Near-identical reports are clustered by sender, subject, body and look.
- Classify, close and notify reporters, with an analyst queue in arrival order.
Other modules
- Vulnerability alertsPublish vulnerability alerts to your entities, collect their exposure answers and track patching deadlines.
- Cyber incidentsAn incident registry with impact matrix, taxonomies, response times and a reconstructed story of each incident.
- Cyber weatherOne weather icon per organization that sums up current security tension, computed from incidents and alerts with rules you set.
- AssetsA referential of domains, IP ranges, brands and technologies, linked to the organizations that own or operate them.
- Phishing campaignsJoin clusters into campaigns by shared infrastructure and spot unusual spikes and recurring waves.
- IndicatorsOne referential for every indicator you assert, with an approval lifecycle and delivery to the tools that act on them.
- ReportsReports built from your metrics, rendered to PDF and delivered on a schedule, each reader seeing only what they may read.
- CatalogPublish tools, services, policies and training to your organizations, organized by a taxonomy you define.
- RequestsUsers ask for access or for a change they cannot make themselves, reviewers approve, and the change applies on approval.
- DocumentsMarkdown documents kept per organization, with archive and permissions.
- DashboardsDrag-and-drop dashboards with charts over your security data, shared per user, per organization or globally.
- ConnectorsConnect MISP, Slack, DNS checks and outbound webhooks, with stored credentials encrypted and health checked.