Skip to content

Contain email compromise

Remove the message from every mailbox that has it.

The hard part of phishing response isn't deciding a message is bad. It's working out who else received it, who interacted with it, and removing it everywhere without breaking something legitimate.

Click through Phishing Remediation in the Demo Center →

The situation

What this usually looks like

If more than two of these are true, the work below is the work you are already doing by hand.

  1. A user reports a message and nobody knows how many others got it.

    The first hour goes on counting rather than containing.

  2. Scoping the recipients is a manual search that takes longer than the removal.

    The slowest step is the one that decides how bad this gets.

  3. Purges happen from a console with no record of what was removed or how to restore it.

    A false positive becomes a second incident.

  4. The identity risk from whoever clicked is handled separately, late, or not at all.

    The phishing incident closes and the account it compromised stays open.

The mechanism

See, decide, act, and then wait.

Four movements, in order. The fourth is the one that matters: nothing destructive happens without a person releasing it.

  1. 1

    See

    A reported message, whatever reported it

    Reports arrive by webhook from KnowBe4 PhishER, Proofpoint TAP, Defender for Office 365 and Rapid7 InsightIDR, or from an analyst by hand. All of them open the same incident type with full headers and content.

    • PhishER
    • Proofpoint TAP
    • Defender for O365
    • Manual submission
  2. 2

    Decide

    Scored, then scoped

    URLs, domains and senders are scored against threat intel while a BEC engine catches display-name spoofs and look-alike domains by edit distance. Microsoft Graph then enumerates every mailbox that received it, Entra tags the Finance, Exec, IT and HR recipients, and Advanced Hunting correlates who actually clicked.

    • VirusTotal
    • BEC heuristics
    • Microsoft Graph
    • Advanced Hunting
  3. 3

    Act

    Removed everywhere it landed

    The message is soft-deleted from recipient mailboxes to Deleted Items, the sender domain goes to the Tenant Allow/Block List and Proofpoint, malicious URLs are blocked, click-through links are rewritten, and affected recipients get a templated warning.

    • Purge
    • Block sender
    • Disable URLs
    • Notify
  4. 4

    Gate

    Reversible, and recorded before it runs

    Nothing destructive executes until an analyst approves the proposed set. If the verdict turns out to be wrong after remediation, the rollback restores soft-deleted mail from Deleted Items and reverts the sender and URL blocks. The incident moves to ROLLED_BACK with the analyst's reason attached.

    • Approve / Reject / Escalate
    • ROLLED_BACK
    • Actor on every transition

The gate

Where an incident goes

A confidence score from 0 to 100 is computed from indicator severity, how widely the message spread, and whether it targeted a privileged role. That score picks the lane.

Runs on its own

auto_execute

High confidence. The remediation set runs and the result is written back to the incident.

The ruleA failed auto-execution lands in the Failed tab with a retry, not in silence.

Waits for a person

hitl

Medium confidence. The incident waits as a card carrying its verdict, mailbox count, click count, high-risk accounts and an SLA countdown.

The ruleApprove executes, Reject closes it as a false positive, Escalate flags it to the security team.

Logged only

monitor

Low risk. The mail is watched rather than touched.

The ruleNothing is purged and nothing is blocked.

A user who clicked becomes a phishing-linked identity alert, so the account risk opens as part of the same event instead of being found a day later.

Who does the work

2 agents, each owning its part.

You can turn one on and add the others later. A connector configured for one is available to the rest.

Also named in this outcome

Coming soon

Security Awareness

Role-based training and phishing simulations that measure and lift human risk resilience.

Questions

The things people ask first.

  • Will it delete mail without asking?

    Only where confidence routes the incident to auto_execute, and only ever as a soft-delete to Deleted Items through Microsoft Graph. Everything in the medium band waits for an analyst, and the rollback path is recorded before any purge runs.

  • What if we get it wrong?

    Roll it back. Soft-deleted messages restore from Deleted Items and the sender and URL blocks revert. The incident moves to ROLLED_BACK and the recovery is logged with the analyst's reason.

  • How does it know who else received the message?

    Microsoft Graph enumerates the mailboxes directly instead of inferring spread from the report. Entra ID tags which recipients sit in Finance, Exec, IT or HR, and Defender Advanced Hunting correlates who actually clicked the link.

  • Does it catch BEC, or only links and attachments?

    Both. A dedicated heuristic engine looks for display-name spoofing and look-alike domains using edit-distance comparison, which is the part a URL reputation lookup can't answer.

  • What happens to the person who clicked?

    They become a phishing-linked identity alert. Identity Compromise correlates the click to that account's subsequent sign-in behaviour, so a click on Monday and a strange sign-in on Tuesday are one story, not two tickets.

The other outcomes