Triage advice
Detecting PHISH emails is helpful in the following scenarios:
Filtering CybSafe reported simulations to skip a SOC triage process
Connecting PHISH to your report button, but to exclusively send CybSafe simulations only.
Every email will contain the keyword in html: cs-unique-ref
<div title="cs-unique-ref:1b54b04f-80fc-47d3-b474-702167740795;">
The HTML shown in BOLD will always be present, so email triage can be automated with an HTML body search for “cs-unique-ref”.
Useful resources
