### 1. Scope & Objective
Standard operating procedures for triaging reported malicious emails.
SecOpsStandard Operating Procedure
Standard Operating Procedure: Email Phishing Triage for SOC Analysts
Step-by-step phishing email investigation SOP: headers inspection, authentication verification (SPF/DKIM/DMARC), and safe artifact extraction.
TDNam SecOps Team12 min readUpdated: 2026-11-04
Tags:#SOC#Phishing#Email Security#IOC#Incident Response
Decree 13/2023/ND-CP Compliance Notice
Educational engineering SOP. Contains zero personal identifiable information under Vietnam Personal Data Protection regulations.