Triage
- Verdict
- unknown
- Severity
- critical
- Risk
- 93.4%
- Confidence
- low
- Action
- manual_review
- Status
- analysis_failed
- Attachment masquerade detected
- DMARC failed
- PDF JavaScript flag present
Catcher
Overview
Case Detail
INC-20260511-0010
Updated employee handbook attached
AI Summary
The LLM did not complete, so deterministic scoring is the only automated verdict source. Manual review should focus on the attachment masquerade and PDF JavaScript signal.
- Advisory
- yes
- Status
- error
- Classification
- unknown
- Model
- demo-llm
- Generated
- 2026-05-11T12:44:11Z
- Action
- manual_review
- Attachment masquerade detected
- DMARC failed
- PDF JavaScript flag present
LLM endpoint timeout after deterministic scoring.
Manual Triage Summary
Pending tier-2 attachment review. Do not notify the reporter until the attachment verdict is confirmed.
- Disposition
- manual_review_required
- Updated by
- tier2.analyst@example.test
- Updated
- 2026-05-11T12:46:00Z
- Created
- 2026-05-11T12:46:00Z
- PDF masquerade flag is set
- One attachment is queued for stego review
Action Broker
Governed action state shown for analyst review before mutation approval.
- Action path
- securityfabric.action-broker -> catcher.notification/email-control
- Approval tier
- human_approval_required
- Execution mode
- mutation
- Dispatch status
- blocked
- Blocked reason
- mutation_denied_without_approval
- Result
- manual_review_required
Dry-run vs mutation mode is controlled by mutation and policy approval tier.
Closure evidence: policy_gate: approval_missing, review_queue: tier2
Callback request/action IDs: tenant-dev/CORR-INC-20260511-0010/ABR-20260511-0010
Callback publish/ingest: published / ingested
Message
- From
- HR Shared Drive <hr-docs@sharepoint-files.example>
- Sender domain
- sharepoint-files.example
- Reporter
- nora.hr@example.test
- Reply-To
- hr-support@example.net
- Return-Path
- bounce@sharepoint-files.example
- Message ID
- <m365-report-0010@example.test>
Signals
- SPF
- softfail
- DKIM
- none
- DMARC
- fail
- Clickable URLs
- 2
- Shorteners
- 0
- Attachments
- 2
- Attachment reputation
- malicious
- Stego reviews
- 1
- QR decoded
- -
- Containers
- -
- Lure theme
- -
- Platforms
- -
- Objectives
- -
- URL enrichment
- -
- Domain enrichment
- -
- Redirects
- -
- Final mismatch
- -
- Browser forms
- -/-
- Threat intel
- -
- Intel matches
- -
URL Enrichment
- Status
- -
- Attempted
- -
- Redirected
- -
- Max hops
- -
- Shorteners expanded
- -
- Blocked/errors
- -/-
No URL trace items are available.
Browser Metadata
- Items
- -
- Password / OTP
- -/-
- CAPTCHA/checks
- -
- Brand mismatch
- -
- Browser final mismatch
- -
- Blocked/errors
- -/-
No browser metadata items are available.
Domain Infrastructure
- Status
- -
- Domains
- -
- DNS / TLS
- -/-
- New domains
- -
- Recent certs
- -
- Blocked/errors
- -/-
No domain infrastructure items are available.
Attachment Coverage
- QR URLs
- none
- PDF QR URLs
- none
- PDF QR scan
- available or not needed
- OCR login page
- not detected
- Disk image / LNK
- -
- Unsupported containers
- -
Threat Intel
- Status
- -
- Matches
- -
- Malicious
- -
- Suspicious
- -
- Sources
- -
No SecurityFabric threat-intel hits are attached to this case.
Pipeline
- Tenant
- tenant-dev
- Evidence ID
- EVID-20260511-0010
- Queue job
- 45
- Run ID
- 20260511_123900_0000_EVID-20260511-0010
- Closed by
- -
- Close reason
- -
- Closure note
- -
Last error: LLM endpoint timeout after deterministic scoring; manual review required.
Artifacts
- evidence_json
- runs/tenant-dev/20260511_123900_0000_EVID-20260511-0010/artifacts/evidence.json
- score_debug_json
- runs/tenant-dev/20260511_123900_0000_EVID-20260511-0010/artifacts/score.debug.json
Comments
- tier2.analyst@example.test2026-05-11T12:46:00Z
Attachment masquerade needs manual review before reporter notification.
Notifications
- analysis_failed2026-05-11T12:45:02Z
failed to nora.hr@example.test (503)
Reporter webhook unavailable after 3 attempts.