Email Analysis Methodology
- Initial Triage
- quickly assess and prioritize
- Header and Sender Examination
- Look at routing path
- Sender IP
- Domain authenticity
- Signs of spoofing
- Content Examination
- Analyze body of email for language, formatting, etc.
- Social engineering red flags
- Web and URL Examination
- Collect web artifacts
- Utilize tools to inspect URLs and domains
- Attachment Examination
- Securely extract and analyze attachments
- Checking rile reputation and sandboxing
- Contextual Examination
- Consider broader context, recent or current incidents
- Look for patterns and assess scope
- Defense Measures
- Take reactive defense action if needed
- Take proactive defense actions
- Communicate with users and stakeholders
- Documentation and Reporting
- Takes place through each stage
- Maintain records of findings, verdicts, and actions taken through detailed reports
- Close out alerts and tickets