CYBRARY Phishing triage queue
Reported mail from the workforce — the single largest slice of real SOC ticket volume. Read the message, pick the evidence that actually proves your call, and take the actions the verdict justifies. Over-reach costs you as much as under-reach.
Action required: your Northstar Benefits payroll election expires today
2026-03-02 08:14From: Northstar Benefits Payroll <no-reply@northstar-benefits.example.payroll-verify.co>
Reply-To: hr-payroll@mailfence.example
Reported by: d.alvarez@northstar-benefits.example (Payroll)
URL: https://payroll-verify.co/northstar/login?u=d.alvarez
Your annual payroll election has not been confirmed. Sign in within 2 hours to avoid a missed deposit.
1 · Verdict
2 · Attach evidence to the ticket
Pick the lines a reviewer, or a court, would accept as proof. Padding the ticket with filler is scored against you.
- headerReturn-Path: <bounce@payroll-verify.co>; SPF=fail (northstar-benefits.example does not designate 198.51.100.24 as permitted sender)
- headerX-Mailer: Outlook 16.0
- urlhttps://payroll-verify.co/northstar/login?u=d.alvarez — domain registered 3 days ago, credential form posts to /collect.php
- bodyMessage contains urgency language ('within 2 hours').
- identityIdP sign-in log: no successful authentication for d.alvarez from an unfamiliar ASN in the last 24h.
3 · Actions
Includes the human calls — identity team, HR and legal, the reporter — not just the console buttons.