Operations
Case Workbench
Operations
Case Workbench
Security Operations
Cases
Live phish triage queue for reported-message review and analyst follow-up.
Case Queue
Triage, closure, message, reporter, signal, and run context for current cases.
| Case | State | Closure Notes | Verdict / Risk | Message | Reporter / Source | Auth | URLs | Attachments | Reasons / Error | Pipeline |
|---|---|---|---|---|---|---|---|---|---|---|
| INC-20260511-0009 EVID-20260511-0009 age: 54d | analysis_running open | Open | spam medium/ 41.2% confidence: medium action: route_to_spam | Limited time renewal discount Newsletter <promo@mailer.example> mailer.example | sam.finance@example.test phish-report@example.test <m365-report-0009@example.test> | SPF: passDKIM: passDMARC: none rollup: mixed | Clickable: 7 Resource: 14 Domains: 3 Short/IDN/IP: 0/0/0 Platform: - Redirects: - · mismatch - Infra new/cert/blocked: -/-/- Browser form/checks: -/- | Count: 0 Reputation: clean Masq/Stego: 0/0 | Bulk marketing footer; List-Unsubscribe present; Link-heavy message | 20260511_122407_0000_EVID-20260511-0009 queue: 44 2026-05-11T12:29:12Z |