How to build phishing report triage

What matters here

• Group reports by campaign before anyone looks. Forty reports of one email is one case.
• Check the email automatically first: sender, reply-to, links, attachments and how new the sending domain is.
• Once a campaign is confirmed, find every copy, not just the reported ones. Most recipients never report.
• Check who clicked. A removed email still matters if somebody entered a password before it was pulled.
• Reply to every reporter with the verdict. People who hear back keep reporting.

Who this is for

You run security operations. The phishing mailbox fills faster than anybody can read it, and the reports you do read are mostly marketing email.

How it works in practice

From an employee pressing the report button to the campaign being closed.

1. 1

   The reported email is read from the phishing mailbox

   With its full headers and attachments, not a forwarded copy that has lost them.

2. 2

   The email is checked automatically

   Sender and reply-to, authentication results, link destinations, attachment types and the age of the sending domain.

3. 3

   Reports of the same email are grouped into one case

   Same sender, subject pattern, links or attachment, within a window.

4. 4

   Clear cases are decided, the rest go to an analyst

   Known marketing and internal mail are closed. Anything unclear arrives with the checks already done.

5. 5

   A confirmed campaign is pulled from every inbox

   Every copy, reported or not, with a list of who opened it and who clicked.

6. 6

   Every reporter hears the verdict

   Safe, spam or phishing, with a thank you. The answer is what keeps people reporting.

Paste these into Claude Code or Codex with the Tray Headless plugin installed. Each stage runs on its own. The systems named in them are the worked example rather than a requirement, and every prompt says so.

Once per project, run /tray-workflows:set-workspace to pick the workspace these build in. Point it at a sandbox first.

1. 1

   Set up, then read reports with their headers

   A forwarded copy has lost the evidence.

   Headless skills build-workflow

   Copy

   Use build-workflow. The systems in play are Gmail or Microsoft
   Outlook for the phishing mailbox, Google Workspace with domain-wide
   access or the Microsoft 365 admin API for searching every mailbox,
   Office365 Management for mailbox activity, Okta, Jira, Slack and
   Snowflake, or whatever we run in those seats. Before you plan anything,
   tell me which of them are already authenticated in the workspace,
   because I do not want a connector stubbed that I have not
   authenticated.
   
   Read each report from the phishing mailbox with the original email
   attached, including its full headers and attachments. If the report
   button forwards a copy instead of attaching the original, tell me,
   because the headers are what most of the checks need.

2. 2

   Check every reported email automatically

   Most reports can be decided from facts a machine can look up.

   Headless skills build-workflow

   Copy

   Use build-workflow. For every reported email, record:
   
     Sender, reply-to, and whether they differ
     Whether the email passed sender authentication
     Whether the sender is internal, a known supplier, or a known
     marketing platform we use
     Every link, where it really goes, and how new that domain is
     Attachment types, and whether any are macros, archives or scripts
     Look-alike domains: our own name with a letter changed
   
   Close the clear cases automatically: our own marketing tools, internal
   mail that passed authentication, and newsletters people subscribed to.
   Send everything else to triage with the checks attached.

   Closing the clear cases is most of the value. Every reported newsletter and internal notice used to take an analyst a few minutes.

3. 3

   Group reports into campaigns

   Forty reports of one email is one case.

   Copy

   Before opening a case, group reports that share a sender, a link
   domain, an attachment, or a subject pattern, within a 24 hour window.
   
   Open one case per campaign in Jira with: the count of reports, the
   first and latest report time, the checks, and one example email.
   Add later reports to the same case instead of opening new ones.
   
   When the analyst gives a verdict on the case, apply it to every report
   in it.

4. 4

   Pull every copy, and find who clicked

   Most recipients never report.

   Headless skills tray-gotchas

   Copy

   Use tray-gotchas. When a case is confirmed as phishing, search every
   mailbox for copies of the email by sender, subject and link, and list
   them with the recipient and whether each was opened.
   
   Removing copies from every mailbox needs an analyst's approval in
   Slack, showing the count and three example recipients. Once approved,
   move them to a held folder rather than deleting them, so a wrong call
   can be put back, and record each removal on the case.
   
   Then check who clicked or replied. For anyone who entered a password
   on a phishing page, open a compromised account case rather than
   treating it as part of this one.

5. 5

   Reply to every reporter

   People who hear back keep reporting.

   Copy

   When a case closes, reply to every reporter with the verdict in plain
   words: safe, unwanted marketing, or phishing that has now been removed.
   Thank them either way.
   
   Report monthly: reports received, share closed automatically, time to
   verdict, campaigns confirmed, copies removed, and the share of
   recipients who reported a confirmed campaign.

6. 6

   Validate it, then hand the rules to security ops

   Because the safe-sender list is a security decision with an owner.

   Copy

   Run the per-step schema checks and the whole-workflow audit before this
   touches production. Run it shadow for two weeks: check and group
   everything, close nothing, remove nothing, and compare its calls with
   what analysts decided.
   
   Then open the same workflow in Tray Build so security operations can
   manage the safe-sender list, the grouping window and the auto-close
   rules in the visual canvas.

What it connects to

Reports arrive in one mailbox, and the copies sit in everyone else's.

Named systems are the ones most teams run, not the only ones that work. Each is an authentication in your Tray workspace, referenced by name, so the workflow never holds a credential. Where we have a connector page, the name links to it.

Questions people ask

Related guides