Review and manage Triage Center cases

Triage Center is an add-on

Triage Center is an add-on and is not included by default. Contact support@jerichosecurity.com to request access for your organization. These instructions apply after access is enabled.

Triage Center helps your security team investigate reported emails. Case assignment, classification, reporter notifications, and mailbox remediation are separate actions: changing a case’s status does not by itself remove a message or create a blocking rule.

Before you begin

• Confirm with Support that your organization has the add-on enabled.
• Sign in as an Admin or Manager to make changes or export data. Viewer access is read-only; see workspace roles.
• For mailbox actions, configure an active supported email server using Connect your email server. Add-on access alone does not grant mailbox permissions.

Find and review a case

1. Open Triage in the navigation.
2. Under Case list, choose Active for open or in-progress cases, or Resolved for closed or dismissed cases.
3. Use the available date, assignee, category, and status filters to narrow the list. Review the selected filters if a case appears to be missing.
4. Open a case and confirm the subject, sender, recipients, timestamp, and case ID.
5. Review Email Content, Overview, Headers, and Timeline where available. Show Plain Text and Show HTML switch the email-content view.

Evaluate the message evidence before changing its classification. A displayed category is not proof that every mailbox action has completed.

Assign a case and update its status

1. Open the case.
2. Use Assigned to… to select a member of your organization.
3. Choose the appropriate status from the status selector.
4. Click Save, then confirm the saved assignee and status.

Open and in-progress cases belong to Active; closed and dismissed cases belong to Resolved. Resolve or dismiss a case according to your team’s handling process. Neither status is a substitute for verifying a requested mailbox action.

Update classification

1. In the case’s Category controls, select the appropriate category.
2. Select the available type under Select Type, where applicable. Changing the category changes the available types.
3. Click Update.
4. Confirm that the saved category and type match your assessment.

Classification uses its own Update control, separate from the Save button for assignee and status.

Notify the reporter

When a case has a classification, Send Verdict Notification is available. Review the saved category, select the button, and confirm Send verdict notification to the reporter?

This requests a notification to the reporter; actual delivery depends on your organization’s notification configuration and processing. A success message is not proof that the reporter has read it. Avoid repeatedly sending the verdict when you are investigating a delivery problem.

Apply mailbox actions

The Remediation Actions section requires an active email server. If it reports No active email servers available, review the email server setup with your administrator.

Move a message out of inboxes

1. Under Move Email Out of Inbox, review the action description.
2. Confirm the affected sender, subject, and recipients. The action can affect other employees who received the same email, not just the reporter.
3. Select Move Email and review the confirmation about moving the email out of employees’ inboxes.
4. Confirm only when that scope matches your intended action.
5. Allow processing to finish, then review the case’s Timeline and verify the result in an affected mailbox with your email administrator.

The action moves matching email threads out of the inbox and applies Jericho Flagged in the connected mail system. The initial message says the work has started; it is not confirmation that every mailbox was updated. If the result says Some emails could not be moved, treat it as partial success and contact Support with the case ID and affected mailboxes.

Create a sender blocking rule

1. Select Block Email.
2. In New Email Blocking Rule, enter Rule Name.
3. Review From Condition carefully. It is prefilled from the reported sender; confirm that it is the sender you intend to target.
4. Review Label Action. Use the available Move to Jericho Flagged action. Move to Trash is displayed but disabled and should not be treated as a supported option.
5. Click Submit and allow the background action to finish.
6. Review Policies and verify the rule’s behavior with your email administrator.

Blocking here uses rules on connected email servers to handle matching messages. It is not a guarantee that a sender is blocked everywhere in your organization. Contact Support if the rule or mailbox behavior does not match the requested action.

Update several cases

1. In Case list, select the intended case checkboxes.
2. Review the selection count.
3. Choose Mark Resolved, Dismiss, or Assign. For assignment, select the intended member using Assign to….
4. Review the resulting cases in Active or Resolved as appropriate.

Bulk status changes do not perform mailbox removal, sender blocking, or verdict notification. Use the case’s separate controls for those actions.

Upload an email for review

1. In the case list, select Upload EML.
2. Choose an email file with the .eml extension, no larger than 10 MB.
3. Wait for the upload result and any subsequent processing before checking the case list.

An upload-success message confirms file acceptance, not completed classification or remediation. If no case appears, check filters and contact Support with the upload time and filename. Do not repeatedly upload the same file to try to force a result.

Create a simulation from a case

1. Open the case and select Create a Campaign.
2. Select the intended people or groups in the recipient picker and confirm your selection.
3. Review the campaign builder that opens, including the generated scenario, message content, audience, and delivery settings.
4. Remove any real sensitive content from the simulation and review its previews before launching through the campaign workflow.

Creating the campaign opens it for review; it does not launch it. If a campaign is already linked, use View Campaign Created to review it instead of creating another from the same case.

Export cases

Use Export CSV in the case list after reviewing your filters. The export is prepared asynchronously and delivered by email. Review the file’s scope and recipients before sharing it; it can contain information from reported messages.

Get help

Contact support@jerichosecurity.com if you need add-on access, a case is missing after processing, or a mailbox action fails. Include the case ID where available, action attempted, approximate time, visible error, and a redacted screenshot. Share message samples only through your organization’s approved process.