> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/email-security/remediation-actions.md). # Remediation actions The actions the Stoïk SOC can take for each type of Email Security detection. ## Suspicious emails ### Warning banner A warning banner is added to the email. Its wording depends on the type of threat detected.
Phishing * **Suspected Impersonation**: This email may impersonate a well-known brand (Microsoft, DocuSign, your bank, etc.) in order to steal your credentials. Do not click any links and do not enter your credentials. If in doubt, go directly to the official website by typing its address into your browser. * **Suspected Quishing**: This email contains a QR code that may redirect you to a phishing page designed to steal your credentials or personal information. Do not scan this QR code with your phone. If in doubt, go directly to the website by typing its address into your browser and verify the request through a trusted channel. * **Suspected Phishing via Attachment**: This email may contain an attachment (PDF, HTML, etc.) concealing a phishing link designed to steal your credentials or personal information. Do not open the attachment and do not click any links it contains. If in doubt, verify the request through a trusted channel. * **Suspected Phishing via Link**: This email contains a link to a legitimate file-sharing service (SharePoint, OneDrive, Google Drive, Dropbox) that may be used as a gateway to a phishing page designed to steal your credentials. Do not enter your credentials on the page that opens. If in doubt, verify with the sender through a trusted channel before opening the file. * **Suspected Spear Phishing**: This email may be a highly targeted phishing attempt, personalized with details about you, your role, or your organization to make it more convincing. Do not click any links and do not download any attachments. Verify the sender's identity through a trusted channel before replying. * **Suspected Phishing** (fallback, used when no specific type of phishing is detected): This email may contain phishing links: URLs designed to steal your credentials or personal information. If in doubt, go directly to the website by typing its address into your browser and verify the request through a trusted channel.
Fraud * **Suspected Fraudulent Contact**: This email may be an initial contact aimed at setting up financial fraud (for example, a request to change an IBAN or pay an invoice). If in doubt, please carry out a double check before taking any action: contact the person only through their usual phone number, never through the contact details mentioned in this message. * **Suspected Sextortion**: This email may be an extortion attempt threatening to disclose intimate images or videos of you unless a payment is made. This is a common scam, and no such content typically exists. Do not pay, do not reply, and report this email to your IT manager. * **Suspected Extortion**: This email may be an extortion attempt: a threat to exploit an alleged vulnerability or supposedly stolen data unless a payment is made. Do not pay, do not reply, and report this email to your IT manager. * **Suspected Gift Card Scam**: This email may be a scam asking you to purchase gift cards and send the codes to the sender, often under the pretext of an urgent request from a colleague or acquaintance. If in doubt, please double-check before taking any action: contact the person only through their usual phone number, never through the contact details mentioned in this message. * **Suspected CEO Fraud**: This email may be an attempt to impersonate an executive in order to push you into carrying out an urgent financial action (wire transfer, gift cards, change of bank details) or into disclosing confidential information. If in doubt, please carry out a double check before taking any action: contact the person only through their usual phone number, never through the contact details mentioned in this message. * **Suspected Vendor Fraud**: This email may impersonate a known supplier or business partner in order to push a fraudulent invoice or a change of bank details. If in doubt, please carry out a double check before taking any action: contact the person only through their usual phone number, never through the contact details mentioned in this message. * **Suspected Payroll Diversion**: This email may be an attempt to redirect an employee's salary payment to a fraudulent bank account. If in doubt, please carry out a double check before taking any action: contact the person only through their usual phone number, never through the contact details mentioned in this message. * **Suspected Fraudulent Request**: This email may contain a request to change a bank account or IBAN for a supplier or a third-party payment. If in doubt, please carry out a double check before taking any action: contact the person only through their usual phone number, never through the contact details mentioned in this message. * **Suspected Financial Fraud** (fallback, used when no specific type of fraud is detected): This email may be a fraud attempt involving a financial request or an invoice. If in doubt, please carry out a double check before taking any action: contact the person only through their usual phone number, never through the contact details mentioned in this message.
Malware * **Suspected Malicious Attachment**: This email may contain a malicious attachment (document with macro, executable, booby-trapped archive) intended to infect your device. Do not open or download this attachment. If in doubt, check with the sender through a trusted channel before opening it. * **Suspected Malicious Link**: This email may contain a link leading to a malicious payload intended to infect your device. If in doubt, verify the link's destination or contact the sender through a trusted channel before clicking. * **Suspected Fake CAPTCHA**: This email or page may redirect you to a fake CAPTCHA or "human verification" screen that prompts you to run a command or script on your computer. No legitimate website asks you to run a command to prove you are human. If in doubt, close the page immediately and report it to your IT manager team. * **Suspected Malicious Content** (fallback, used when no specific type of malware is detected): This email may contain malicious content (link, attachment, or embedded code) intended to infect your device or compromise your data. Do not click any links and do not open any attachments. If in doubt, check with the sender through a trusted channel before taking any action.
Spam * **Suspicion of Unsolicited Prospecting**: This email may be unsolicited commercial prospecting: an offer, an introduction, or a proposal you did not request. Do not reply and do not click any link if you did not initiate this exchange. If in doubt, ignore this message and verify the sender's identity through a trusted channel. * **Suspicion of Mass Mailing**: This email may be a mass mailing (newsletter, promotion, or commercial communication) you did not opt into. Do not click any link, including an unsubscribe link, if you do not recognize the sender. If in doubt, ignore this message and do not share any information. * **Suspicion of Deceptive Commercial Spam**: This email may be an aggressive commercial message using deceptive tactics (fake urgency, misleading offer, spoofed sender) to get you to click, buy, or share information. Do not click any link, do not open any attachment, and do not share any data. If in doubt, ignore this message and report it to your IT manager. * **Suspicion of Spam** (fallback, used when no specific type of spam is detected): This email may be an unsolicited commercial message. Do not reply, do not click any link, and do not open any attachment if you were not expecting this message. If in doubt, ignore it and report it to your IT manager.
Generic * Used when no specific category (fraud, phishing, malware, spam) is detected: This email has been flagged as suspicious. As a precaution, do not click any link, do not open any attachment, and do not share any information. If in doubt, verify with the sender through a trusted channel before taking any action.
### Quarantine The email is moved to a dedicated `Stoïk Quarantine` folder. The employee no longer sees it in their inbox, and it remains recoverable. ## Compromised accounts When an account is identified as compromised, the Stoïk SOC can: * **Reset password**: issues a temporary password that must be changed at the next login. * **Reset session**: revokes all active sessions, forcing re-authentication on every device. * **Delete inbox rules**: removes a mailbox rule (forwarding, auto-deletion, etc.). * **Delete applications**: revokes an application or OAuth grant. * **Delete MFA method**: removes an authentication method. * **Delete device**: permanently deletes a device registered on the account. * **Delete passkey**: removes a passkey added by an attacker. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.stoik.io/email-security/remediation-actions.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.