🎣 The Reported Email
A user reports a suspicious DocuSign email. Is it one phish or a whole campaign? Balance rigor, containment, and the trust of the person who reported it.
Whose job is this?
This incident lands on these classes' desks. Their guides carry the certifications, tools and labs that make the calls you just made feel routine.
- Security Operations Center (SOC) AnalystinitiateFighter → SOC Analyst
- Security Awareness Specialist / GRC AnalystinitiateBard → Security Awareness Specialist
Not sure which one is you? Roll a character.