Phishing email got through to 3 users — need confirmation blocked

TKT-0010 High Resolved Alert Query

Created By: s.jones
Created: 2026-09-28 19:59
Last Updated: 2026-10-03 03:56

Assigned Analyst: Marcus Webb
Category: Alert Query
Messages: 7

Conversation

s.jones Customer

2026-09-28 19:59

We received an alert notification and would like some clarification on its severity and whether any action is required from our side.

Regarding: Phishing email got through to 3 users — need confirmation blocked

Could you review and let us know if this is something we should be worried about?

Marcus Webb SOC Analyst

2026-09-28 21:23

I've updated the DLP policy as requested. The HR shared drive is now excluded from the external transfer monitoring rule, but internal audit logging remains active.

s.jones Customer

2026-09-28 23:17

Thanks. Could you also check if any other accounts were affected?

Marcus Webb SOC Analyst

2026-09-29 01:06

Good news — our analysis confirms this is a true positive. We've implemented the containment measures and will send a full incident summary within 24 hours.

s.jones Customer

2026-09-29 02:51

Thanks. Could you also check if any other accounts were affected?

Marcus Webb SOC Analyst

2026-09-29 03:27

We've applied the policy change you requested. It will take effect within 15 minutes across all monitored endpoints. Please let us know if you see any issues.

s.jones Customer

2026-09-29 06:48

The affected user has confirmed they changed their password. Can you verify MFA is active?

Ticket Resolved

This ticket has been resolved. If you need to reopen it or have further questions, you can create a new ticket.