Returning to FIG. 22, upon clicking on any of the clusters 1015, the user is displayed a cluster summary. An example cluster summary 1100 is depicted in FIG. 23. The cluster summary 1100 may display a list of all messages assigned to the cluster. Each message may display a “to” address 1110, a “from” address 1112, a reporter score 1114, rule matches 1115 (where hovering over a rule displays details about the rule), as well as any other data associated with the message such as a subject, a received time, a reported time, and a severity level. The cluster summary 1100 may also have a preview panel 1150 to preview an individual message from the list of messages. The preview panel 1150 may contain options to display message headers 1120, a text-only view 1121, as well as a URL option 1124 to display all URLs contained in the selected message. Clicking on any message in the list may cause the console module to display message summary information about the message that was clicked in the preview panel 1150, or open a new message summary. As detailed below, the cluster summary 1100 may also have a button 1130 or link to create a rule directly from the cluster. As an alternative to a cluster summary 1100, the system may display a continuously scrollable list of all reports in the cluster.
