Operations

Case Workbench

Demo data mode: synthetic Catcher cases and notification events are being displayed.
Operations

Case Workbench

Security Operations

Cases

Live phish triage queue for reported-message review and analyst follow-up.

Total1
Open1
Queued0
Running0
Completed0
Failed1
Malicious0
High/Critical1

Case Queue

Triage, closure, message, reporter, signal, and run context for current cases.

1 shown
Reset
AllQueuedRunningCompletedFailed
CaseStateClosure NotesVerdict / RiskMessageReporter / SourceAuthURLsAttachmentsReasons / ErrorPipeline
INC-20260511-0010
EVID-20260511-0010
age: 54d
analysis_failed
open
Openunknown
critical/ 93.4%
confidence: low
action: manual_review
Updated employee handbook attached
HR Shared Drive <hr-docs@sharepoint-files.example>
sharepoint-files.example
nora.hr@example.test
phish-report@example.test
<m365-report-0010@example.test>
SPF: softfailDKIM: noneDMARC: fail
rollup: failed
Clickable: 2
Resource: 3
Domains: 2
Short/IDN/IP: 0/0/1
Platform: -
Redirects: - · mismatch -
Infra new/cert/blocked: -/-/-
Browser form/checks: -/-
Count: 2
Reputation: malicious
Masq/Stego: 1/1
Attachment masquerade detected; DMARC failed; PDF JavaScript flag present
LLM endpoint timeout after deterministic scoring; manual review required.
20260511_123900_0000_EVID-20260511-0010
queue: 45
2026-05-11T12:44:31Z