Methods, network devices, and machine-readable media for an integrated environment and platform for automated processing of reports of suspicious messages, and further including automated threat simulation, reporting, detection, and remediation, including rapid quarantine and restore functions.
Using the notion that related phishing emails will contain similar content a number of indicators are calculated using the body data and attachments of the email.