Collect in one place all the emails that employees marked as suspicious.
Triage each report: review the content, headers, attachments and links before making a decision.
Classify each incident by category (Threat, Spam, Clean, Unknown) and track its status from start to finish: Received → Under Review → Resolved.
Reply to the employee who reported it with a message based on the resolution type you chose.
Keep a complete record of every action in the incident history.
Download the whole inbox as a CSV file to analyze it outside the platform.
Navigation: Amenazas (SIEM) → Incidentes
Inbox
Go to Amenazas (SIEM) → Incidentes. The screen is called Inbox and shows the list of reported emails.
The list shows these columns: From, Category, Subject, Reported by and Reported on. At the far left, each row has a status icon: hover over it and it tells you whether the report is Received, Under Review or Resolved.
Filter by status with the four buttons at the top: All · Received · Under Review · Resolved. The active one is highlighted.
Use the Search bar to find a specific report by sender, subject or reporter.
The Filters icon, at the top right, opens a panel with more criteria: status, category, who reported it, sender, subject and a date range.
The download icon, next to Filters, downloads the inbox as a CSV (siem_emails.csv). It respects the filters and search you have applied, and includes all pages, not just the one you are viewing.
When you hover over a row, quick actions appear on the right: delete, move to either of the other two statuses, download the .eml and reply to the reporter.
The category is not changed from there: you do it by clicking the label in the Category column, which opens the menu with the four options.
Click any row to open the Incident detail.
At the top right of the title there is a Show previous view button, which goes back to the old inbox design. It is an emergency exit while the redesign settles in; the list and the data are the same. To come back, the same button reads Show new design.
The automatically suggested category
Automatic link analysis is available for companies that have it enabled. If your company has it, when a report comes in the platform analyzes the links in the email by itself and proposes a category. You see this in the Category column as long as nobody has classified the email by hand:
Analyzing...: the analysis is running.
Retry (in red): the analysis failed. The button launches it again. Only people with write permission see it.
A category with a wand icon next to it: this is the automatic proposal. When you hover over it, the tooltip says: "Category suggested automatically".
How the analysis verdict translates into the suggested category:
Analysis verdict | Suggested category |
|---|---|
Clean | Clean |
Suspicious | Spam |
Threat | Threat |
A category with the wand was not set by anyone on your team. It is a suggestion, and it still counts as pending review. As soon as someone classifies the email by hand, the manual choice replaces the suggestion and the wand disappears.
When you will NOT see a suggestion.
If your company does not have automatic analysis enabled, the column and the tab look the same as always, with no "Analyzing..." and no wand. If you want to turn it on, talk to your Whalemate representative.
The analysis only runs on emails that are saved in the inbox. If your company has the option to save them turned off, there is no analysis because there is no email to analyze.
Reports that arrive through the Whalemate bot are not analyzed automatically yet.
If the email had no links, there is nothing to analyze: the category stays Unknown, with no wand, and the Domain & URLs tab says so.
The suggestion is only a guide, even when the link was analyzed correctly. A domain registered a few days ago is not yet on any reputation list, so it can come back as "Clean" even if it belongs to an attacker. The final classification is still decided by the reviewer.
Incident detail
The header shows: the subject, the status label, the category label (Threat / Spam / Clean / Unknown), the sender (From), the recipient (To) and a trash icon to delete.
Below it there is a strip with the report data: From, Received on, Reported by, Reported on and IP address.
Available tabs:
Preview: shows the email rendered as the user received it.
Raw message: the raw content of the email.
Headers: the technical headers, grouped into four blocks so you do not have to read them all: Authentication and Phishing (what is critical for detecting spoofing), Tracking (tracing the origin), Technical (Google and Microsoft headers) and Context.
Attachments: a table with Name, Type and the View and Download buttons. If the email had no attachments, it says so instead of staying blank.
Domain & URLs: the sender's domain and all the URLs found in the email, in three blocks, from top to bottom:
Security analysis: the result of the automatic analysis (only if your company has it enabled).
Sender information: the sender's domain.
Link information: the full list of URLs in the email.
Inside Security analysis you will find:
A verdict summary: "N link(s) detected as a possible threat", "...with suspicious signals" or "No threats detected in the analyzed links".
The list of Analyzed links, with the verdict for each one and, where it applies, the threat type: Social engineering, Malware, Unwanted software, Potentially harmful application or Unclassified threat.
The notice "This is an automatic suggestion. The final analysis is left to the administrator's judgment."
Depending on when the analysis is, this section shows a different message:
Analyzing the links…: the analysis is running. The screen updates by itself, no need to reload.
The automatic analysis could not be completed.: the analysis failed. The Retry button launches it again (only people with write permission see it).
This email had no links to analyze.: there is no list of analyzed links.
Links are read as addresses, not as pieces of code. The email add-in sometimes extracted the address with the message's own code stuck on the end, something like
https://sitio-falso.com/entrar/</u></span>, and the verdict was requested for an address that did not exist. Now they are cleaned before they are checked and before they are saved, so what you see is the address the person would have opened.If a link came in so broken that no address can be recovered, it still appears in Link information: nothing the email contained is discarded. It just is not among the analyzed ones, because there is nothing to check.
Reports from before this change keep the address as it was saved then. The fix applies to emails that come in from now on.
History: records every status change, every category change and every reply sent, with author and date/time.
Reply to the reporter
From the incident detail (or from the row's quick action), open Reply to user.
At the top, To: shows the email of the person who reported it.
Choose a Resolution type. Each one comes with its message already written and also defines what state the incident ends up in:
Resolution type | Message it sends | What it leaves the incident as |
|---|---|---|
Phishing | Real threat: warns the user | Category Threat + Resolved |
False positive | Legitimate email: reassures the user | Category Clean + Resolved |
Spam | Unwanted email, no risk | Category Spam + Resolved |
Under review | Still being analyzed | Status Under Review (does not touch the category) |
Custom reply | The text you write | Resolved, without changing the category |
The Preview shows the exact message the reporter will receive, with their name already filled in.
If you choose Custom reply, the free text field opens (up to 5,000 characters). While it is empty, the send button stays disabled.
At the bottom left there is a checkbox that is on by default. It says "Mark as resolved on send", except when you chose Under review, where it says "Mark as Under Review on send".
That checkbox controls everything in the "What it leaves the incident as" column. If you leave it checked, sending applies the status change and the category change. If you uncheck it, the reply is still sent but the incident stays exactly as it was: same status and same category.
Click Send reply to confirm, or Cancel to discard.
Each reply and each status or category change is recorded in the History tab.
What do the categories mean?
Threat = confirmed malicious email. Spam = unwanted email with no risk. Clean = legitimate email. Unknown = not classified yet.
What is the difference between status and category?
The status shows what stage of the process the report is in (Received, Under Review, Resolved). The category shows what type of email it is (Threat, Spam, Clean, Unknown).
Can I change the category while I reply?
Yes, but not by choosing it: the resolution type sets it. Phishing leaves the email as Threat, False positive as Clean and Spam as Spam. If you want to reply without touching the classification, uncheck "Mark as resolved on send" before sending, or use Custom reply, which does not change the category. To choose a category by hand, do it from the label in the Category column in the list.
An email shows as "Threat" and nobody has reviewed it yet. Why?
It is the automatic analysis suggestion. You can tell by the wand icon next to the label. It counts as pending until someone confirms or changes it.
I don't see "Analyzing..." or the wand on any email. Is it broken?
Most likely your company does not have automatic analysis enabled, or the email was not saved in the inbox, or it arrived through the Whalemate bot. If you want to turn it on, talk to your Whalemate representative.
An email stayed as "Unknown" with no wand. Why does it have no suggestion?
If the email had no links, there is nothing to analyze. In the Domain & URLs tab you will see "This email had no links to analyze".
A clearly malicious link came back as "Clean". Is the analysis broken?
Not necessarily. The analysis checks the link against a reputation service, and a domain registered a few days ago is not on any list yet. That is why the suggestion is only a guide and the final decision belongs to the reviewer.
In an old report I see a link with code stuck on the end.
It is a report from before the fix that cleans the addresses. Reports already saved keep what was saved at the time; new ones come in clean.
Can I download the inbox to Excel?
Yes, with the download icon in the top bar. It downloads a CSV with all the reports that match the active filters, not just the page you are viewing.
Where do I see the URLs and the domain of the reported email?
In the Domain & URLs tab inside the incident detail.
How do I know what happened with an incident and who handled it?
In the History tab, which lists each action with the user who did it and the exact date/time.
The inbox is empty and I know my people report emails.
Check in Configuración → Botón de Reporte that the option Store reported emails on the platform is turned on. With that option off, reports are forwarded by email but are not stored on the platform. Also keep in mind that emails from a phishing simulation never come in here: they are recorded as "reported" inside the campaign.
Do you have feedback or want to request improvements? Tell us at roadmap.whalemate.com/roadmap
