Who this guide is for
You are a junior security analyst, often called a Tier 1 or SOC (Security Operations Center) analyst, in your first months on the job. You may also be an IT help-desk technician who has been handed reported emails, or a student preparing for a SOC role. The guide assumes you:
- know basic networking terms such as IP address, domain, and URL;
- can use an email client and a web browser comfortably;
- have not yet investigated a phishing email on your own.
What you will be able to do
By the end of the guide, you will be able to answer the three questions behind every phishing ticket:
- Is it malicious?
- Who else received it?
- Did anyone act on it?
This guide does not cover full incident response after an account is compromised, malware reverse engineering, or building email filters. When you reach those situations, the procedure tells you to escalate.
How to use this guide
- If you are new, start with Key Terms. Every later page uses those words.
- Read What the Research Says once to understand why this work matters.
- Keep Step-by-Step Triage open while you work a real ticket.
- See the steps applied in the Worked Example.
- Check the FAQ & Troubleshooting page when something does not match the steps.
Your playbook comes first
Always follow your organization's policies and escalation contacts. Where this guide and your team's playbook disagree, your playbook wins.