AegisAI Lab · Lab Note 004
Most of the work in a phishing queue is repeat work: the same campaign, reported many times, checked by hand each time. Here is a step-by-step triage workflow that does the repeat work once and keeps analysts on the cases that need them.
To reduce SOC time spent on phishing triage, give users one way to report, enrich every report automatically, group reports of the same campaign into one incident, remove that campaign from every mailbox in one action, and keep analysts for the reports tied to stolen credentials, malware or money. Each step removes work an analyst would otherwise repeat for every ticket. Measure the queue before you start, so you can show what changed.
Source for losses: FBI IC3 2025 Internet Crime Report.
This phishing triage workflow is ordered on purpose. Measuring comes first because the result has to be shown, and automation comes before grouping because grouping depends on the data enrichment collects.
Record reports per week, the share that needed an analyst, time from first report to removal, and how many tickets each campaign created. These numbers are your baseline.
One button, one reporting mailbox. In Microsoft 365, use the built-in Report button in Outlook and set a reporting mailbox. In Gmail, users report through the message menu.
Parse headers and SPF, DKIM and DMARC results, extract links and file hashes, and add sender reputation before an analyst opens the ticket.
Cluster reports by sender infrastructure, links, attachment hashes and subject patterns. One campaign becomes one parent incident.
Once an incident is confirmed, search for every copy and remove it in one action, then block the sender infrastructure.
Route reports tied to credential entry, odd sign-ins, mailbox rule changes, payment changes or executive impersonation to a person.
Every reported message becomes a ticket, and every ticket needs a decision. Many reported messages turn out to be harmless, such as marketing mail or a real vendor invoice, but each still has to be checked. A single campaign sent to a whole department makes the problem worse: without grouping, each person who reports it opens a separate ticket.
Reporting is still the right habit. CISA tells people to report the phish to protect yourself and others rather than click or reply. The answer to a large queue is a better workflow behind the report button, not fewer reports.
Five checks make up most of the hands-on work for each reported email. The table shows what each one involves and how to cut the effort.
| Manual step | What it involves | How to cut the effort |
|---|---|---|
| Header extraction | Reading SPF, DKIM and DMARC results, reply-to addresses and routing | Automate Parse headers when the report arrives |
| Link and attachment analysis | Opening links and files safely to see what they do | Automate Send extracted links and file hashes to automated analysis |
| Sender reputation lookup | Checking threat intelligence, domain age and sending history | Automate Add reputation data to the ticket automatically |
| Recipient scoping | Finding everyone who received the same message | Automate Run a mailbox search from the first confirmed report |
| Identity check | Looking for credential entry, suspicious sign-ins and new mailbox rules | Analyst Keep with a person, supported by sign-in and mailbox-rule data |
Filtering before delivery also shrinks the queue, because fewer bad messages reach users to be reported. CISA's #StopRansomware Guide recommends attachment filters for file types that commonly carry malware, with the list reviewed at least every six months, and macros turned off for Office files sent by email.
Treating 100 reports of the same campaign as 100 investigations spends analyst time on work that has already been done. Grouping reports into one parent incident means the campaign is investigated once.
One campaign, one investigation
The same phishing email, reported by many users, handled two ways.
Without grouping
One ticket per report
With grouping
One parent incident per campaign
Match reports on these signals, in this order:
Then open one parent incident per campaign and attach every matching report to it. Users still get a reply, and analysts work one case.
Once a campaign is confirmed, remove every copy in one action instead of one mailbox at a time. Both major platforms support this.
Microsoft 365. Set up the user reported message settings so reports reach a reporting mailbox your team watches. Microsoft recommends the built-in Report button over the older Report Message and Report Phishing add-ins. To clean up, select the messages in Threat Explorer and choose an action such as soft delete or move to junk. The Search and Purge role is needed to approve those actions. With Defender for Office 365 Plan 2, automated investigation and response can run a playbook on user-reported email and, for malicious similarity clusters, approve the cleanup automatically.
Google Workspace. In the security investigation tool, search Gmail log events for the campaign, select the results, and delete the messages, mark them as phishing, or send them to quarantine. Admins may also be able to record a justification for each action, which helps when you review incidents later. Users report suspicious mail in Gmail itself, as described in Gmail Help.
The second through hundredth reports of the same campaign should cost almost no analyst time. If they do, the grouping step is missing.
AegisAI LabAutomation should take the repeat work, not the judgment. Send these cases to a person every time:
These are the signs of business email compromise, which often carries no link or file to scan. It caused $3,046,598,558 in reported losses across 24,768 complaints in 2025. When an account is affected, CISA's phishing guidance recommends re-provisioning suspected or confirmed compromised accounts, auditing access afterwards to confirm the attacker is out, and isolating the affected workstation.
Track the same metrics before and after each change. Your own before-and-after numbers are the most convincing evidence that triage time went down.
| Metric | What it measures | Goal |
|---|---|---|
| Analyst-touch rate | Share of reports that needed a person | Down |
| Report to removal time | Minutes from the first report to removal from every mailbox | Down |
| Closed automatically | Share of reports resolved with no analyst | Up |
| Tickets per campaign | How many tickets one attack created | Down, toward 1 |
| False positive rate | Harmless messages wrongly flagged | Down |
| Missed compromises | Real attacks that automation closed without escalating | Zero |
For a wider set of measures, see how to evaluate email security vendors, and for why reported phishing gets past filters in the first place, see why a secure email gateway can still miss phishing.
AegisAI investigates every email for what it is trying to do and removes the ones that fail from every mailbox they reached. Every verdict comes with its reason in plain language, so your team can check it and share it, and verdicts and indicators can be exported to your SIEM. In monitoring mode, AegisAI records verdicts without acting, so you can compare its findings with your current queue first. Read more about inbound email security, or book a demo to see it on your own mail.
Give users one way to report, enrich every report automatically, group reports of the same campaign into one incident, remove the campaign from every mailbox in one action, and keep analysts for cases involving stolen credentials, malware or payment requests. Measure the queue before and after so you can show the change.
A phishing triage workflow has six steps: measure the current queue, standardize user reporting, enrich each report automatically, group duplicate reports into one incident, remediate the campaign across all mailboxes, and route identity and payment cases to an analyst.
Header parsing, link and attachment analysis, sender reputation lookups, finding every recipient of the same message, grouping duplicate reports and removing confirmed campaigns can all be automated. Checking whether a user's account was affected should stay with an analyst, supported by sign-in and mailbox-rule data.
Group the reports into one parent incident, investigate once, and remove the message from every mailbox it reached in one action. Then block the sender infrastructure so the next wave is stopped earlier.
In Microsoft 365, select the messages in Threat Explorer and choose an action such as soft delete; the Search and Purge role is needed to approve it. In Google Workspace, search Gmail log events in the security investigation tool, select the results and delete them, mark them as phishing or send them to quarantine.
Treat it as an identity incident. CISA recommends re-provisioning suspected or confirmed compromised accounts, auditing account access afterwards to confirm the attacker no longer has access, and isolating the affected workstation. Also check sign-in logs and mailbox rules for changes.
Track analyst-touch rate, time from first report to removal, share of reports closed automatically, tickets per campaign, false positive rate and missed compromises. Record each one before you change the workflow, then compare.
AegisAI investigates every email for what it is trying to do and removes the ones that fail from every mailbox they reached. Each verdict comes with its reason in plain language so analysts can check it, and verdicts and indicators can be exported to a SIEM. Monitoring mode records verdicts without acting.
