Phishing is an attempt to obtain sensitive information used in fraud and impersonation. This includes attempts to acquire personal information, such as social security numbers, bank account numbers, or PIN codes and passwords. It is crucial to ensure that these data types are protected across the entire organization. Phishing, especially spear phishing, is often used to gain initial access within a network. When receiving a phishing email, analysts can use SIEM to track who received them, clicked on any links in them, or replied to them, enabling them to take immediate action to minimize damage.
label=Email label=Receive subject IN ['Payroll Deduction Form', 'Please review the leave law requirements', 'Password Check Required Immediately', 'Required to read or complete: "COVID-19 Safety Policy"', 'COVID-19 Remote Work Policy Update', 'Vacation Policy Update', 'Scheduled Server Maintenance -- No Internet Access', 'Your team shared "COVID 19 Amendment and Emergency leave pay policy" with you via OneDrive', 'Official Quarantine Notice', 'COVID-19: Return To Work Guidelines and Requirements']
| chart count() by source_address, subject, sender, receiver, destination_host