Intake: report-to-triage in under 60 seconds
Every enterprise needs a report phishing button in the M365 or Google Workspace toolbar. The reported message hits ManySignal's phishing intake connector which extracts headers, links, attachments, and the reporting user, then opens a case with the triage agent scored.
The triage agent runs the phishing question set: sender reputation, URL reputation, domain age, DMARC pass/fail, attachment hash lookup, similarity to known campaigns. Every question resolves in seconds; the verdict lands in under a minute for 90% of reports.
IOC extraction and enrichment
Extract URLs, sender addresses, IP addresses, and attachment hashes. Look them up against your threat-intel feeds (VirusTotal, PhishTank, in-house denylists). ManySignal's enrichment resolver ships with connectors to all major TI feeds; add your own via the universal HTTP action.
Domain age from WHOIS is one of the most predictive signals — phishing kits usually run on domains registered in the last 30 days. Any URL against a domain <30 days old gets a high suspicion weight even without a TI match.
Impact scoping via the entity graph
Once a message is confirmed malicious, the entity graph resolves: how many other users received it, who clicked, who entered credentials on the linked page. This is the single highest-value automation in phishing response — the manual version takes hours.
For clicks, correlate with authentication events in the following window: a compromised credential shows as an authn_success from an unusual ASN shortly after the click. That correlation fires an identity-takeover response workflow.
# detections/phishing/credential_after_click.yaml
key: phishing.credential_after_click
type: correlation
where:
class_uid: 4001
category: email
correlate:
window: 30m
group_by: identity_id
sequence: [phishing_click, authn_success]
behavioural:
dimensions: [geographic, device]
min_joint_score: 60
Containment: mailbox rules + credential rotation
Two containment actions handle 80% of phishing incidents: (1) delete any suspicious mailbox rule created after the click, (2) revoke active sessions + require MFA re-enrol for the affected identity.
Both actions are approve-gated by default because they interrupt the user's workflow. On high-confidence verdicts (>85) with human confirmation of 'not me', escalate to autonomous — speed matters more than approvals when credentials are actively burning.
- Auto-delete mailbox rules created within 60min of confirmed click
- Revoke sessions on 'not me' human confirmation
- Notify manager on any credential rotation
- Auto-block sender domain tenant-wide if 3+ users received the same message
Metrics that matter
Report-to-verdict time (target: <2min), report-to-containment time (target: <10min for confirmed), false-positive rate (should be <15%), and click-to-detect time (how long between the user clicking and ManySignal detecting the compromise — target <5min).
Key takeaways
- Automate intake with a report-phishing button; case opens in <60s.
- Domain age <30d is one of the highest-signal features.
- Entity graph resolves 'who else clicked' in seconds — this is where hours are saved.
- Two actions cover 80%: delete mailbox rule + revoke sessions.
- Target: report-to-verdict <2min, report-to-containment <10min for confirmed.