Triage Security Alerts and Phishing

Get an evidence-led verdict on every suspicious email, link or alert, related alerts grouped into one incident, and the containment steps ready to approve.

About

Cut through security noise: forward what looks wrong and get a clear verdict, the evidence behind it and what to do next.

What it does

Analyses suspicious emails and links: headers, sender, reputation, landing page, with every indicator defanged
Groups alerts from different tools that describe the same incident into one timeline
Reads authentication logs for brute force, password spraying and suspicious successful logins
Weighs ransomware signs and drafts the containment steps from your playbook
Guides the response to a leaked key: disable, rotate, check what it did
Writes detection rules (Sigma or your SIEM's language) mapped to MITRE ATT&CK, with test cases

What you need

Nothing to start: paste a suspicious email, link or alert
Malwarebytes ScamGuard checks links and senders with nothing to connect
Optional: your security, cloud or ticketing tools from the Rerun catalogue, to read alerts and act on them

How setup works

A verdict on a suspicious email or alert arrives in the first minutes. Along the way it learns your tools, playbooks and who approves containment, then triages one real alert.

What stays in your hands

It never isolates a machine, revokes a key or blocks a sender without your go-ahead

What you will need

Malwarebytes ScamGuard

Coworkers in this template

SOC Analyst

Investigates suspicious emails, links and security alerts, and drafts the detection rules and containment steps that stop the next one.

Apps

Skills · 6

Check a suspicious email or link

Use when asked whether an email, link, attachment, sender or phone number is phishing or malicious.

Group related alerts

Use when asked to triage a batch of security alerts, merge alerts from several tools that describe the same incident, or open a consolidated case.

Review failed logins

Use when asked to review sign-in or authentication logs, explain a burst of failed logins, or alert when failures pass a threshold.

Revoke a compromised key

Use when an API key, token, password or cloud credential has leaked or may have, or when asked to revoke, rotate or log a compromised secret.

+2 more

Frequently asked questions

How do I check if an email is phishing?

Paste the email with its headers. It checks SPF, DKIM and DMARC, the sender and reply-to, the links' reputation and landing page, and gives a verdict with the evidence and next steps.

Can it isolate a machine or revoke a key automatically?

It drafts the exact steps from your playbook and runs them through a connected tool only after you approve. Without a connected tool, it gives you the steps to run.

Does it work with my SIEM or EDR?

It works from the alerts and logs you paste, and writes rules in Sigma or your SIEM's query language. Tools available in the Rerun catalogue can be connected to read alerts directly.

Can it write Sigma detection rules?

Yes. Each rule names the behaviour, the MITRE ATT&CK technique, the log source, known false positives, and comes with events that should and should not trigger it.

Does it open suspicious links?

It checks them through reputation services and scanners rather than browsing them in a normal session, and every link in its reports is defanged.

How much does it cost to run?

The template is free. Each run uses Rerun credit, like any coworker.

2,000+ businesses run on Rerun

Hire Coworkers on the ChatGPTplan you already pay for.

1. Plug in your subscription
2. Set up your Coworkers
3. Run your business with Coworkers

Start now for free

Rerun

Run your work on coworkers. Build them, watch them work, and keep your eyes on everything.

What it does

What you need

How setup works

What stays in your hands

Apps

Skills · 6

More Other templates

Collections Specialist

Loan Officer

Insurance Broker

Hire Coworkers on the ChatGPTClaudeChatGPTChatGPTplan you already pay for.

Hire Coworkers on the ChatGPTplan you already pay for.