Reading results
Stoik Email Security monitors your mailboxes for two types of threats: suspicious emails and compromised accounts. All detected threats are listed in Stoik Protect and reviewed by the Stoik SOC.
Email threats
Email threats are suspicious or malicious emails detected in your mailboxes, of two types:
Fraud: financial fraud attempts, such as invoice fraud or impersonation of a known contact.
Phishing: emails linking to a page that impersonates a known brand to steal credentials.
They are listed on the Suspicious emails screen, under Email Security in the sidebar.
Each row in the table displays:
Subject: the email subject line
Criticality: Low, Medium, High, or Critical
Protected user: the mailbox that received or sent the email
Detection date: when the email was received
Status: Open or Closed
Validity : Undefined, False Positive or True Positive
Actions : None, Banner and/or Quarantine
Click on any email threat to open a full page with full details.
Alert Information
The Information section displays the metadata of the flagged email:
Detection date -- when the email was received
Protected user -- the mailbox that received or sent the email
Traffic -- inbound or outbound
Mailbox -- Microsoft 365 or Google Workspace
Type -- the threat type: Fraud or Phishing
Reasons -- the reasons the email was flagged (e.g. Impersonating user, Suspicious banking info)
Actions -- the actions taken by the SOC (e.g. email moved to quarantine, warning banner added)
Status -- whether the threat is Open or Closed
Validity -- True Positive or False Positive
Verdict
A colored banner at the top summarizes the overall assessment. The banner color and headline match the alert's criticality:
Critical
Critical fraud attempt detected
High
High-risk fraud attempt detected
Medium
Suspicious activity detected
Low
Minor anomalies detected
A short summary below the headline provides additional context. Email Security alerts are managed by the Stoik SOC: no action is required on your side.
Attacker Informations
The Attacker section is closed by default, when open it displays informations regarding the Sender such as :
Sender name
Sender domain
Sender email address
Activity
The Activity section is a reverse-chronological timeline of everything that happened to an alert. Each entry includes its date and time. The most recent event appears first.
Alert handling
Alert creation
When the email was originally received.
Alert confirmation
When the alert was ingested and confirmed in the Stoik system.
Alert processing
When a SOC analyst started investigating the alert.
Alert closure
When the alert was resolved and closed.
Alert creation and Alert confirmation always appear. Alert processing and Alert closure appear as the alert progresses.
SOC actions and alert updates
The timeline records actions performed by the SOC. These include adding a warning banner and moving an email to quarantine.
It also records alert updates. For example, the validity can change from Undefined to True Positive or False Positive.
Signal checks
Three signal checks appear in the timeline. Each check shows a colored dot:
A problem was found
An anomaly was detected
The check passed
Sender identity
Verifies if the sender is impersonating a known contact in your organization.
Communication history
Verifies if this sender has previously communicated with your organization.
Sender reputation
Checks the sender's domain and email address against known threat databases.
Email exchanges
The timeline includes emails exchanged between Stoïk and your organization. These entries show how the alert was communicated and resolved.
Analyst Notes
Some alerts include analyst notes written by the Stoik SOC. These notes provide additional context on how the alert was investigated and resolved.
Not all alerts have analyst notes, they are added when the SOC team considers additional context relevant.
Email Content
The Email Content section embeds the original flagged email directly in the side panel, so you can see exactly what landed in the inbox and understand the verdict in context.
It includes:
Senders the address(es) the email was sent from
Recipients the mailbox(es) the email was sent to
Subject the email subject line
Sending date when the email was sent
Warning banner when added by the Stoik SOC, the banner displayed to end users at the top of the email
Body the full email content, with original formatting, images and links
Click Expand to open the email in a larger pop-in for easier reading.
If the email contains attachments, they are listed in a dedicated Attachments section below. Stoïk analyzes attachments (such as PDFs) for phishing and fraud indicators, for example embedded links or IBANs, but does not scan their content for malware. Downloaded files are therefore not guaranteed to be malware-free: protection against malicious files relies on the security solution installed on your devices.
Compromised accounts
Compromised accounts are mailboxes showing signs of unauthorized access or suspicious activity. They are listed on the Compromised accounts screen, under Email Security in the sidebar.
Each row includes a Detected signals column, listing the signals behind the alert, grouped by type with their number of occurrences (e.g. 3 Impossible travels · 2 Abnormal behaviors).
Click on any compromised account to open a full screen with full details.
Alert Information
The Information section displays:
Detection date: when the compromise was detected
Status: whether the alert is Open or Closed
Validity: True Positive or False Positive
Protected user: the mailbox that was targeted
Actions : None, MFA reset, Password reset, etc
Criticality: Low, Medium, High, or Critical
User profile
A baseline of what's normal for this user, computed from the last 13 weeks of their sign-in activity. Use it as a reference point when reading the Timeline below.
Usual location
The top countries this user signs in from (with the share of sign-ins for each).
Usual device
The operating system and browser the user typically uses.
Usual sign-in pattern
A weekly heatmap showing when the user is normally active.
VPN usage
How often this user signs in through a VPN.
Email throughput
How many emails this user sends per day on average, with their historical peak.
Coverage
The number of sign-ins the baseline is computed from.
Activity
The Activity section is a reverse-chronological timeline of the signals that triggered the alert and the actions taken by the Stoik SOC. Events are grouped by day. Each entry shows the time, an icon, and a short explanation.
Detected signals
The timeline shows the signals that led to the alert:
Impossible travel detected — two sign-ins too far apart given the time between them.
Sign-in from high-risk country — sign-in from a country flagged in our threat database.
Sign-in from unusual location / network / device / browser — the user signed in from a context they don't usually use.
Sign-in at unusual time — sign-in outside of the user's normal working hours.
Automated access detected — sign-in coming from a headless browser or automation tool.
Suspicious app access — access from a tool often used by attackers (e.g. Graph Explorer, Azure CLI).
High email volume detected — the user sent significantly more emails than usual in 24 hours.
Suspicious inbox rule created — a rule was created on the mailbox that auto-deletes, forwards or hides messages.
Authentication method added or removed — an MFA method was changed on the account.
Sign-in from known malicious IP — sign-in from an IP listed in our threat feed.
VPN used — sign-in via VPN, on a user who rarely uses one.
Session reused across devices — the same session ID was seen from two different OS/browser combinations.
Microsoft Entra flagged high risk — Microsoft's own identity protection raised an alert.
Failed MFA attempt — an MFA challenge failed.
SOC actions
The Stoik SOC can take the following actions to contain a compromised account:
Reset password — force a new temporary password. The user must change it at the next sign-in.
Reset session — revoke every active sign-in session. Every device must reauthenticate.
Delete inbox rules — remove a specific mailbox rule, such as a forwarding or auto-delete rule.
Delete applications — revoke a specific app assignment from the user.
Delete MFA method — remove a specific authentication method.
Delete device — permanently delete a device the user owns or registered.
Alert handling
The timeline also tracks how the alert was handled:
Alert creation
When the compromise was detected.
Alert confirmation
When the alert was ingested and confirmed in the Stoik system.
Alert processing
When a SOC analyst started investigating the alert.
Alert closure
When the alert was resolved and closed.
Alert creation and Alert confirmation always appear. Alert processing and Alert closure appear as the alert progresses.
Analyst Notes
Some alerts include analyst notes written by the Stoik SOC. These notes provide additional context on how the alert was investigated and resolved.
Not all alerts have analyst notes, they are added when the SOC team considers additional context relevant.
Email exchange
Some alerts include email exchanges related to the alert handling. When available, these communications are displayed in the side panel, giving you the full context of how the alert was communicated and resolved.
This section only appears when there are related emails
Last updated
Was this helpful?