HARBOR-17 / 02 / PRACTICE GUIDE
Phishing and email investigation
Review displayed sender, authentication headers, destination domains and user impact together. Develop evidence without opening suspicious destinations.
Download guide and workpapersOriginal AI-assisted SecNet educational content; examples are fictional. Not a source organization publication or endorsement. Sources checked: 2026-10-21.
EVIDENCE REVIEW DESK
Move from observations to decisions.
Code here is a local policy model with no target connection. Passing model cases are not security approval or device tests.
The header saying pass / Incomplete decision
Inspect an incomplete decision based on record existence or another positive signal. Consider denial cases alongside permitted use.
s=>s.authPassauthPass needs trusted-receiver and alignment review. Fraudulent content remains possible after authentication passes; independently verify content and business request.
Choices and outputs last only on this open page; they do not update account progress, career status, points or certificates.
01 / EXPLANATION
Display name and trusted receiver
The displayed helpdesk name is not the actual sender domain. Authentication-Results is meaningful only from a receiver within the relevant trust boundary; an attacker-supplied lookalike header is not proof. Passing SPF/DKIM/DMARC cannot guarantee legitimate content or a business request. Record gaps in raw headers, receiving infrastructure and forwarding context. Harbor’s text export does not parse MIME or validate actual headers.
02 / EXPLANATION
Domain and link chain
HTTPS describes transport, not trustworthiness. Review exact host spelling, Unicode/punycode rendering, subdomain boundaries and redirects in an authorized environment. This exercise opens no destinations and uses reserved example domains. Verify payment or credential requests through a pre-established independent channel, not contacts in the message. Running attachments or links on an analyst’s everyday machine is not an investigation step.
03 / EXPLANATION
User impact and other recipients
Deleting a message cannot undo a click, session or submitted information. Correlate recipients, click records, user statements and identity events within explicit windows. Scope mailbox/export authority and avoid unnecessary copies of content or personal data. MITRE T1566 supports behavioral classification; a matching record does not establish actor or campaign attribution.
04 / EXPLANATION
Harbor-17 email decision
mail-export provides only normalized recipient/time details, without trusted receiver headers. A familiar name cannot establish safety; missing headers alone cannot prove malice. Request raw records, domain review and user/session attribution. The desk shows a sign-in two minutes after a click: a working correlation, not a verdict. Do not close the case by deleting the message before reviewing recipient scope and identity impact.
Build the evidence yourself.
Blank workpapers are not completed tests. Fill them in your authorized environment without secrets or real personal data.
Full guide with code, outputs and reasoning ↓Primary references
Explanations are authored by SecNet. References support method and platform context; verify current editions and organizational policy for real use.