Phishing attempt search interface
AssigneeServiceNow, Inc.
InventorsDeepakeswaran Sundaragopal Kolingivadi, Amit Sharma, Santosh Reddy Poreddy, Sachin Shivarama Nayak
Life of this patent
Estimating the term…
Abstract
Systems, methods, and media are used to identify phishing attacks. A notification of a phishing attempt with a parameter associated with a recipient of the phishing attempt is received at a security management node. In response, an indication of the phishing attempt is presented in a phishing attempt search interface. The phishing attempt search interface may be used to search for additional recipients, identify which recipients have been successfully targeted, and provide a summary of the recipients. Using this information, appropriate security measures in response to the phishing attempt for the recipients may be performed.
Claims20
A system, comprising:
- one or more client instances hosted by a platform, wherein the one or more client instances are accessible by one or more remote client networks, and wherein the system is configured to perform operations comprising:
- receiving, at a security management node of the system, a notification of a phishing attempt with a parameter associated with a recipient of the phishing attempt;
- presenting an indication of the phishing attempt in a phishing attempt search interface;
- searching a log store for additional recipients of the phishing attempt based at least in part on the parameter;
- identify which of the recipient and additional recipients have been successfully targeted by the phishing attempt using an observable interaction with the phishing attempt, wherein the observable interaction is a detected interaction with the phishing attempt by a user;
- providing a summary of the recipient and the additional recipients as either an attempted target or a phished target;
- and
- performing security measures in response to the phishing attempt for the attempted targets or the phished targets.
A method comprising:
- presenting an indication of a phishing attempt in a phishing attempt search interface that has been received by a recipient;
- receiving a selection of a search location;
- in response to use of the phishing attempt search interface, searching the search location for additional recipients of the phishing attempt based at least in part on a parameter of the phishing attempt;
- in response to use of the phishing attempt search interface, identify which of the recipient and additional recipients have been successfully targeted by the phishing attempt using an observable interaction with the phishing attempt, wherein the observable interaction is a detected interaction with the phishing attempt by a user;
- providing a summary of the recipient and the additional recipients as either an attempted target or a phished target;
- and
- performing security measures in response to the phishing attempt for the attempted targets or the phished targets.
Tangible, non-transitory, and computer-readable media having stored thereon instructions, that when executed by one or more processors, are configured to cause one or more processors to:
- receiving, at a security management node, a notification of a phishing attempt with a parameter associated with a recipient of the phishing attempt;
- presenting an indication of the phishing attempt in a phishing attempt search interface;
- receiving a search location in the phishing attempt search interface,
- in response to receiving the search location in the phishing attempt search interface, searching the search location for additional targets of the phishing attempt based at least in part on the parameter;
- identifying the recipient and the additional targets as affected users;
- identify which of the affected users have interacted with an observable aspect of the phishing attempt, wherein the observable interaction is a detected interaction with the phishing attempt by a user;
- identifying the affected users that have interacted with the observable aspect of the phishing attempt as victim users;
- providing a summary of the affected users and victim users;
- and
- performing security measures in response to the phishing attempt for the affected users or the victim users.
Dependencies are inferred from the claim text.