Incidents
In PhishTitan, potential threats are called incidents. An incident can be flagged by the system or by a user using the TitanHQ for Outlook add-in.
Go to PhishTitan > Incidents to view, take action on (remediate), and manage incidents in PhishTitan.
Note
If you have auto remediation set up, then PhishTitan will automatically send malicious mails to a user's junk folder. See Remediation for more details.
Incidents are divided into two groups, which can be accessed by selecting either the Action Needed or Resolved tabs at the top of the page.
The Action Needed tab opens by default when you select PhishTitan > Incidents and displays incidents requiring admin attention. These are Incidents that have been reported by users using the TitanHQ for Outlook add-in. When you mark these mails as safe or move them to junk, they are automatically moved to the Resolved tab.
The Resolved tab contains mails that have been automatically flagged by the system and ones you have taken action on are also listed here. No further action is required for these incidents.
Use the search
box to search the list of incidents.Select the column
icon to display the table column names. Slide each on and off to view or hide a column. The following columns are available:Date: The date the reported email was received.
Subject: Email subject line of the reported email.
Sender: Sender email address of the reported email.
Flag Reason: The reason this email was flagged for further investigation. See Incident Flag Reasons.
Recipients: The number of users that received this email on the customer tenant.
Status: The current status of this incident. See Incident Status Descriptions.
Customer: The PhishTitan customer this incident is related to.
Actions: Actions available for this incident.
From the Actions column, you can do the following:
To view additional details of an incident, select the view
icon for the incident. The Incident Summary page will display.To add a sender to the Allow List, select the allow sender
icon for the incident. See Allow List for further details.To add a domain to the Allow List, select the allow domain
icon for the incident. See Allow List for further details.
Incident Flag Reasons
Flag Reason | Description |
|---|---|
User Reported Phishing | A user reported this email as phishing with the TitanHQ for Outlook add-in. |
User Reported Clean | A user reported this email as clean with the TitanHQ for Outlook add-in. |
Suspicious Text | PhishTitan detected suspicious text in the body of this email. |
Malicious Links | PhishTitan detected malicious links in the body of this email. |
Incident Status Descriptions
Status | Description | Available Actions |
|---|---|---|
 | An email has been flagged by a user as phishing or clean using the TitanHQ for Outlook add-in. This incident needs Admin attention and review. | Allow Sender Mark as Safe Send to Junk |
 | Administrator has reviewed this email and determined it was malicious and selected to move it to a user's Junk folder. This email has been moved to the Junk folder for all recipients. | Allow Sender Mark as Safe |
 | PhishTitan has flagged this email as suspicious and applied a warning banner before delivering to a user's Inbox. | Allow Sender Mark as Safe Send to Junk |
 | Administrator has reviewed this email and determined it is safe. Once marked as safe, the email is then delivered to all recipients with a banner marking it as safe. | Allow Sender Send to Junk |
 | Auto remediation has been enabled meaning that this email has automatically been moved to the Junk folder for all recipients. | Allow Sender Mark as Safe |