> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/email-security/suspicious-emails.md). # Suspicious emails Email Security detects suspicious or malicious emails in your mailboxes. The Stoïk SOC reviews every alert: no action is required on your side. There are two types of email threats: * **Fraud:** financial fraud attempts, such as invoice fraud or impersonation of a known contact. * **Phishing:** emails linking to a page that impersonates a known brand to steal credentials. ## Alerts table Alerts are listed in `Email Security` > `Suspicious emails`. Each row shows: * **Subject:** the email subject line * **Criticality:** Low, Medium, High, or Critical * **Protected user:** the mailbox that received or sent the email * **Detection date:** when the email was received * **Status:** Open or Closed * **Validity:** Undefined, False Positive or True Positive * **Actions:** None, Banner and/or Quarantine Click an alert to open its details. ## Alert details ### Information * **Detection date**: when the email was received * **Protected user**: the mailbox that received or sent the email * **Traffic**: inbound or outbound * **Mailbox**: Microsoft 365 or Google Workspace * **Type**: Fraud or Phishing * **Reasons**: why the email was flagged (e.g. Impersonating user, Suspicious banking info) * **Actions**: the actions taken by the SOC (e.g. email moved to quarantine, warning banner added). See [Remediation actions](/email-security/remediation-actions.md). * **Status**: Open or Closed * **Validity**: True Positive or False Positive {% hint style="info" %} Highly suspicious emails are not deleted. They are moved to a `Stoïk Quarantine` folder, created automatically on the mailbox at the first quarantine action, so they remain recoverable. {% endhint %} ### Verdict A colored banner at the top summarizes the assessment. Its color and headline match the alert's criticality and type. For a fraud alert:
CriticalityHeadline
CriticalCritical fraud attempt detected
HighHigh-risk fraud attempt detected
MediumSuspicious activity detected
LowMinor anomalies detected
For a phishing alert, the headline reads "phishing" instead of "fraud" (for example, "Critical phishing attempt detected"). A short summary below the headline gives more context. ### Attacker Closed by default. It shows the sender name, sender domain and sender email address. ### Email content The original email, as it landed in the inbox: senders, recipients, subject, sending date, the warning banner added by the SOC if any, and the full body with its formatting, images and links. Click **Expand** to read it in a larger window. Attachments are listed below. Stoïk analyzes attachments (such as PDFs) for phishing and fraud indicators, for example embedded links or IBANs, but does not scan them for malware. Protection against malicious files relies on the security solution installed on your devices. ## Activity timeline The Activity section lists everything that happened to the alert, most recent first. ### Alert handling
StepMeaning
Alert creationWhen the email was originally received.
Alert confirmationWhen the alert was ingested and confirmed in the Stoik system.
Alert processingWhen a SOC analyst started investigating the alert.
Alert closureWhen the alert was resolved and closed.
**Alert creation** and **Alert confirmation** always appear. **Alert processing** and **Alert closure** appear as the alert progresses. {% hint style="info" %} When Email Security is first activated, emails received up to 90 days before activation are scanned. For these emails, the gap between **Alert creation** and **Alert confirmation** can be large. This is expected. {% endhint %} ### Signal checks Each check shows a colored dot: a problem was found, an anomaly was detected, or the check passed.
CheckWhat it does
Sender identityVerifies if the sender is impersonating a known contact in your organization.
Communication historyVerifies if this sender has previously communicated with your organization.
Sender reputationChecks the sender's domain and email address against known threat databases.
The description of each check reflects its actual result. For example, `Sender reputation` reads "The sender's domain or email address matches known threat databases." when flagged, and "The sender's domain and email address were not found in known threat databases." when passed. ### SOC actions, notes and emails * **SOC actions and updates**: warning banners, moves to quarantine, and validity changes (for example from **Undefined** to **True Positive**). * **Analyst notes**: context written by the Stoïk SOC on how the alert was investigated, when relevant. * **Email exchanges**: the emails exchanged between Stoïk and your organization about the alert. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.stoik.io/email-security/suspicious-emails.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.