Phishing attempt categorization/aggregation interface
Systems, methods, and media are used to identify phishing attacks. A notification of a phishing attempt with a parameter associated with a recipient of the phishing attempt is received at a security management node. In response, an indication of the phishing attempt is presented in a phishing attempt search interface. The reported phishing attempts may be aggregated based upon specified criteria to avoid redundant incidents that may hinder remediation efforts.
1. A tangible, non-transitory machine readable medium, comprising machine-readable instructions that, when executed by one or more processors of a machine, cause the machine to:
receive a plurality of phishing report submissions, wherein each phishing report submission of the plurality of phishing report submissions comprises respective suspected phishing emails;
extract, from each suspected phishing email of the respective suspected phishing emails, respective email headers and respective sets of key observables;
determine, based on a first email header of the respective email headers, a first set of key observables of the respective sets of key observables, or both, whether a first suspected phishing email of the respective suspected phishing emails matches criteria specified by a rule for creation of a new security incident in an incident monitoring system;
in response to determining that the first suspected phishing email matches the criteria for creation of the new security incident, create the new security incident;
determine, based on a second email header of the respective email headers, a second set of key observables of the respective sets of key observables, or both, whether a second suspected phishing email matches aggregation criteria specified by an aggregation rule for associating the second suspected phishing email with the new security incident;
in response to determining that the second suspected phishing email matches the aggregation criteria for associating the second suspected phishing email with the new security incident, consolidate the first set of key observables with the second set of key observables; and
provide a representation of the new security incident to a display device for display, wherein the representation comprises a consolidated set of key observables associated with the new security incident.
2. The tangible, non-transitory machine-readable medium of claim 1 , comprising machine-readable instructions that, when executed by the one or more processors of the machine, cause the machine to:
provide a rule graphical user interface (GUI), the rule GUI providing selectable options for generating the rule.
3. The tangible, non-transitory machine-readable medium of claim 2 , wherein the selectable options comprise a set of selectable rule outcomes for the rule, the selectable rule outcomes comprising: creating an alert and creating an incident.
4. The tangible, non-transitory machine-readable medium of claim 2 , wherein the selectable options comprise selectable criteria.
5. The tangible, non-transitory machine-readable medium of claim 4 , wherein the selectable criteria comprises: a source email address of the first suspected phishing email, a source email domain of the first suspected phishing email, or any combination thereof.
6. The tangible, non-transitory machine-readable medium of claim 4 , wherein the selectable criteria comprises: a submitter identifier associated with the first suspected phishing email, contents of a subject line of the first suspected phishing email, contents of a body of the first suspected phishing email, or any combination thereof.
7. The tangible, non-transitory machine-readable medium of claim 4 , wherein the selectable criteria comprises: a file attachment name, a file hash, a source Internet Protocol (IP) address associated with the first suspected phishing email, or any combination thereof.
8. The tangible, non-transitory machine-readable medium of claim 2 , wherein the selectable options comprise an option for designating the rule as active or inactive.
9. The tangible, non-transitory machine-readable medium of claim 2 , wherein the rule GUI comprises one or more fields for defining a priority order associated with applying the rule with respect to one or more additional rules.
10. The tangible, non-transitory machine-readable medium of claim 1 , comprising machine-readable instructions that, when executed by the one or more processors of the machine, cause the machine to:
provide an aggregation rule graphical user interface (GUI), the aggregation rule GUI providing selectable aggregation options for generating the aggregation rule.
11. The tangible, non-transitory machine-readable medium of claim 10 , wherein the selectable aggregation options comprise a set of selectable aggregation rule outcomes for the aggregation rule, the selectable aggregation rule outcomes comprising creating a child incident.
12. The tangible, non-transitory machine-readable medium of claim 10 , wherein the selectable aggregation options comprise selectable aggregation criteria.
13. The tangible, non-transitory machine-readable medium of claim 12 , wherein the selectable aggregation criteria comprises: a source email address of the first suspected phishing email, a source email domain of the first suspected phishing email, a submitter user identifier associated with the first suspected phishing email, contents of a subject line of the first suspected phishing email, contents of a body of the first suspected phishing email, a source Internet Protocol (IP) address associated with the first suspected phishing email, or any combination thereof.
14. The tangible, non-transitory machine-readable medium of claim 1 , wherein providing the representation of the new security incident to the display device comprises providing a representation of an aggregated view graphical user interface (GUI) to the display device, wherein the aggregated view GUI comprises an indication of an association between the new security incident, a first phishing report associated with the first suspected phishing email, and a second phishing report associated with the second suspected phishing email.
15. The tangible, non-transitory machine-readable medium of claim 14 , wherein the indication of the association comprises a first indication that the new security incident is a parent incident, a second indication that the first phishing report is associated with a first child incident of the parent incident, and a third indication that the second phishing report is associated with a second child incident of the parent incident.
16. A computer-implemented method, comprising:
receiving, via a computing device, a plurality of phishing report submissions, wherein each phishing report submission of the plurality of phishing report submissions comprises respective suspected phishing emails;
extracting, from each suspected phishing email of the respective suspected phishing emails via the computing device, respective email headers and respective sets of key observables;
determining, via the computing device, based on a first email header of the respective email headers, a first set of key observables of the respective sets of key observables, or both, whether a first suspected phishing email of the respective suspected phishing emails matches criteria specified by a rule for creation of a new security incident in an incident monitoring system;
in response to determining that the first suspected phishing email matches the criteria for creation of the new security incident, creating, via the computing device, the new security incident;
determining, via the computing device, based on a second email header of the respective email headers, a second set of key observables of the respective sets of key observables, or both, whether a second suspected phishing email matches aggregation criteria specified by an aggregation rule for associating the second suspected phishing email with the new security incident;
in response to determining that the second suspected phishing email matches the aggregation criteria for associating the second suspected phishing email with the new security incident, consolidating, via the computing device, the first set of key observables with the second set of key observables; and
providing, via the computing device, a representation of the new security incident to a display device for display, wherein the representation comprises a consolidated set of key observables associated with the new security incident.
17. The computer-implemented method of claim 16 , wherein the representation of the new security incident comprises an indication of one or more users affected by the new security incident.
18. The computer-implemented method of claim 16 , wherein the representation of the new security incident comprises respective links to the first suspected phishing email and the second suspected phishing email.
19. The computer-implemented method of claim 18 , comprising:
receiving input indicative of a selection of a particular link of the respective links to the first suspected phishing email; and
providing an additional representation of information associated with the first suspected phishing email, wherein the information comprises a source email address associated with the first suspected phishing email, a subject associated with the first suspected phishing email, a destination email address associated with the first suspected phishing email, a text body associated with the first suspected phishing email, or a combination thereof.
20. A computer system, comprising:
one or more processors configured to:
receive a plurality of phishing report submissions, wherein each phishing report submission of the plurality of phishing report submissions comprises respective suspected phishing emails;
extract, from each suspected phishing email of the respective suspected phishing emails, respective email headers and respective sets of key observables;
determine, based on a first email header of the respective email headers, a first set of key observables of the respective sets of key observables, or both, whether a first suspected phishing email of the respective suspected phishing emails matches criteria specified by a rule for creation of a new security incident in an incident monitoring system;
in response to determining that the first suspected phishing email matches the criteria for creation of the new security incident, create the new security incident;
determine, based on a second email header of the respective email headers, a second set of key observables of the respective sets of key observables, or both, whether a second suspected phishing email matches aggregation criteria specified by an aggregation rule for associating the second suspected phishing email with the new security incident;
in response to determining that the second suspected phishing email matches the aggregation criteria for associating the second suspected phishing email with the new security incident, consolidate the first set of key observables with the second set of key observables; and
provide a representation of the new security incident to a display device for display, wherein the representation comprises a consolidated set of key observables associated with the new security incident.