Use the Barracuda Forensics & Incident Response wizard to identify a new incident:
- Log into Barracuda Forensics & Incident Response.
- In the Incidents screen, click New Incident.
- In the New Incident page, enter the Email Subject and/or Sender Email in the provided fields, and click Search Messages.
The Review recipients page displays all matching results for the entered criteria.
- If your search returned too many emails, click Refine Search to better target the suspicious mails. Return to Step 3, described above.
Otherwise, click Review Users at Risk to create a new incident and proceed to Step 6.
- The Users at Risk page presents you with recipients that clicked on a link in an email in the incident. As an added security measure, you can copy the list and send an email to the affected users with instructions on changing their passwords.
Click Review Remediation Options to proceed.
- On the Remediation Options page, select one or more actions, then click Begin Remediation. Note that these actions might take several minutes to complete.
- Delete selected emails permanently from affected users' inboxes. This action requires Barracuda Sentinel.
- Send a warning email alert to the affected users. Click Edit Email Alert to customize the message.
- Review the suggested additional actions, then click Close.