Phish Identification and Similar Phish

Phish identification and similar phish

When Petra detects that a user has interacted with a phishing email, it identifies the specific message and can find "similar phish"—the same or related emails that may have been sent to other users in the tenant. That helps you contain the campaign by removing the email from everyone's mailbox and notifying or warning affected users. This article explains how phish identification and similar phish work from a user's perspective.

How Petra identifies the phish

For phishing-related incidents, Petra ties the incident to the specific email(s) the user interacted with—the one they opened, clicked, or that triggered malicious activity. You'll see this on the incident: which message was the phish, and often metadata such as subject, sender, or time. That way you're not guessing which email caused the problem; you have a clear target for removal and for user communication.

What "similar phish" means

Attackers often send the same or very similar phishing email to many people in an organization. Petra can search the tenant for emails that match or are similar to the one in the incident—same sender, same subject, same link, or similar content. The result is a list of "similar phish": other instances of the same campaign that may be sitting in other users' inboxes. Without this, you might only remove the email from the one user who was compromised and miss everyone else who received it. With similar phish, you can see the full scope and take action across all affected mailboxes.

Using this in your response

From the incident view you can often trigger an action to delete the phish from the affected user's mailbox, or from all mailboxes where the similar phish was found. That reduces the chance of other users clicking the same link or attachment. You can also use the list of similar phish to decide who to notify or warn. Combining phish identification with similar phish gives you a campaign-level response instead of a single-user fix, which is important for containing phishing attacks quickly.