Ravindra BagaleCourses & study guides Track your progress

Guides

How to Analyse a Phishing Email Like a SOC Analyst

By , Cyber Security trainer LinkedIn Published: Last updated:

A SOC-style phishing analysis preserves the original message, reads authentication and routing headers, inspects links and attachments safely (no casual detonation on your laptop), checks reputation, decides phish / spam / false positive, then contains and documents. Stay high-level and defensive — this is triage discipline, not malware reverse-engineering.

Friends, a user says "this mail looks suspicious". A SOC analyst does not panic — they follow a process. Preserve → headers → links/files in safe tools → reputation → decision → ticket. Today that beginner flow as a vertical list.

Quick answer

Triage order:

  1. Preserve the original email (full headers / .eml), not only a screenshot.
  2. Note reporter, time received, and whether anyone already clicked.
  3. Read From, Reply-To, Return-Path, Received chain, and auth results (SPF/DKIM/DMARC if present).
  4. Extract URLs and file names without opening them on a production laptop.
  5. Check reputation with your approved tools (browser isolation, URL scanner, sandbox).
  6. Decide: phishing / spam / legitimate / inconclusive.
  7. Contain (block sender/URL, reset creds if clicked), notify stakeholders, write the ticket.

Analyst notepad template:

Case ID:
Reporter:
Subject:
From / Reply-To / Return-Path:
Auth results (SPF DKIM DMARC):
URL / attachment hashes (from safe tool):
Clicked? (yes/no/unknown):
Decision + actions:

What do I need before this guide?

  • Access to a sample phishing mail in a lab mailbox (or a vendor “phishing quiz” sample).
  • Your organisation’s safe-browsing / sandbox procedure if at work.
  • Optional: What is phishing and SPF/DKIM/DMARC.

What does the SOC phishing flow look like?

SOC analyst phishing triage flow Preserve the email, extract headers and links safely, check reputation, then contain and report. 1. Preserve original 2. Read headers (Received, Auth) 3. Detonate links in a safe tool 4. Check sender / URL reputation 5. Contain, ticket, notify users Decision phish / spam / legit

SOC phishing triage: preserve the email, read headers, inspect links safely, check reputation, then contain and document the decision.

  1. Preserve evidence so headers stay intact.
  2. Understand who sent it and how it arrived.
  3. Inspect indicators safely.
  4. Decide and contain.
  5. Record lessons for detection engineering (mail rules, blocks, user awareness).

How do I analyse the email step by step?

Step 1 — Preserve and ask the click question

  1. Save as .eml or use “show original” / “view headers” export.
  2. Ask: did anyone click, open an attachment, or enter a password?
  3. If yes, start password resets and session revocation in parallel (see IR guide).

Step 2 — Header reading (high level)

  1. Compare display name with the actual From domain.
  2. Check Reply-To for a mismatch trap.
  3. Skim the Received path for odd geography relative to the claimed brand (heuristic only).
  4. Read Authentication-Results for SPF / DKIM / DMARC when present.
  5. Remember: pass does not always mean “safe” (compromised real accounts exist); fail does not always mean “drop without review”.
  1. Copy URLs into your approved detonation / rewrite tool — not into your daily browser profile.
  2. Record final domains after redirects (from the tool’s report).
  3. For attachments, use a sandbox or a disposable lab VM with no corporate SSO session.
  4. Note file type tricks (double extensions, HTML smuggling) at a descriptive level only.

Step 4 — Reputation and context

  1. Check domain age / categorisation with approved intel sources.
  2. Search your SIEM / mailbox search for the same subject or sender (campaign?).
  3. Compare with brand-new vendor announcements using out-of-band channels.

Step 5 — Decision, containment and documentation

  1. Label the case (phish / spam / legit / needs more data).
  2. Block indicators per your playbook (mail filter, proxy, firewall).
  3. If credentials may be exposed: force reset, revoke tokens, review mailbox rules.
  4. Close the ticket with clear timeline and artefacts (headers hash, screenshots of tool output).
  5. Feed one improvement (user banner, block rule, awareness tip).

Ravindra Bagale's Tip

💡 Opening a phishing link on the analyst laptop to "check" it is a common mistake — corporate session cookie risk. Use a safe tool or isolated browser. And a screenshot alone is not evidence — keep the original .eml. Remember this!

How do I fix common phishing-triage mistakes?

Ghabru naka 😅 — these are the usual ones:

Symptom Likely cause Fix
Only a screenshot in the ticket User forwarded wrongly Ask for original / “show original”; educate reporters
Marked safe because SPF passed Compromised mailbox send Still inspect links; contact purported sender out-of-band
Opened attachment locally No sandbox habit Use lab VM / vendor sandbox only
No idea who clicked Forgot to ask Make “clicked?” the second question every time
Duplicate tickets Campaign blast Search subject/sender first; link cases

Try it at home

Use a known fake sample from a phishing-awareness quiz (not a live attack mail). Fill the notepad template above with seven lines filled. Time yourself — aim for a calm 15-minute first pass.

Learn it properly

Got it? SOC phishing triage = preserve, headers, safe link/file check, reputation, decision, contain, document. "Did anyone click?" — never skip that question. Calm process > panic click.

Frequently asked questions

Why keep the .eml file?

Screenshots lose headers and authentication results that analysts need.

Does SPF pass mean the mail is safe?

Not always. Compromised real accounts can still pass SPF. Keep inspecting links and context.

Should I open the suspect link on my laptop?

No. Use an approved sandbox or isolated browser without corporate sessions.

What is the second question after “what is the subject”?

Did anyone click, open an attachment, or enter a password?

What goes in the ticket?

Timeline, headers summary, indicators, decision, containment actions and follow-ups.

Which related guides help?

Phishing basics, SPF/DKIM/DMARC and the incident response first-24-hours guide.