Topic starter
11/11/2026 6:01 pm
TL;DR: Phishing triage turns into campaign hunting when Tracecat has the agent derive a method-based query from the evidence, then reuse that query to draft detection. Mailboxes, not just alerts, become the operational scope, so the response has to validate technique rather than individual messages.
Editorial analysis by NHI Mgmt Group, based on content published by Tracecat: “Agentic phishing triage and threat hunting with Sublime Security”.
Key questions
Q: Why do phishing detections miss copied messages?
A: Phishing detections miss copied messages when they rely on exact text matches, sender reputation, or known URLs, because attackers often reuse the same lure with a new domain, attachment, or account.
Q: What is the difference between a phishing triage case and a hunt?
A: A phishing triage case is the handling of a specific suspected message or user report, where an analyst validates indicators, scopes impact, and decides containment.
Q: How do I hunt phishing campaigns across mailboxes?
A: Use the first confirmed message to derive the attacker method, then run a query across the full retention window for mail that matches that technique.
Practitioner guidance
- Constrain agent output to proposed evidence Let the agent draft hunt queries, case notes and detection candidates, but require a human to approve anything that changes mail handling or enables a rule.
- Search for technique, not just indicators Write hunt logic around the lure method, then test it against the full retention window so unflagged copies surface even when the sender or subject changes.
- Separate detection authoring from activation Keep detection proposals in a reviewable queue until a named approver validates the tests and deliberately enables the rule.
Bottom line: Phishing triage is only the first step; the real control question is whether the same attack method can be found elsewhere in the mailbox estate.
Glossary terms: Threat Hunting, Mailbox Retention Window, Phishing Campaign, Detection Rule
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Campaign-level phishing response is now a control problem, not a queue problem. The important decision is no longer only whether one email is malicious. It is whether the organisation can turn that verdict into a hunt and a detection that covers the next delivery of the same method. That shifts the governance burden from message review to evidence handling, query quality and approval boundaries.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: How should teams approve agent-written detection rules?
A: Teams should approve agent-written detection rules through the same change control used for human-authored rules, with peer review, test data, rollback, and clear ownership before production use. The review should check logic, false-positive risk, required data sources, and whether the rule is aligned to the intended threat model for agent-written detections, rather than accepting code automatically because an agent generated it.
👉 Read our full editorial: Agentic phishing triage uses one query to scope and detect campaigns