Data Points

✉️ Email Header

🔗 Analyst pivots

🔌 Sources that yield Email Header (1)

🧭 Disciplines

🎯 Mission Domains

🔍 Lookup

📜 Playbook — Email Header exploitation

1. Direction — frame the requirement for Email Header: what decision does this support, by when?
2. Collection — pull the 1 mapped sources (0 free) and the native workbench; capture provenance and observe OPSEC.
3. Processing — normalize, de-duplicate and enrich the collected data.
4. Analysis — correlate against local holdings; apply ACH; assign confidence.
5. Dissemination — open a case, draft a report, share via STIX/MISP.
6. Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

🧩 Advanced Capabilities

✨ Enrichment pathways

🎫 Email Header

The full RFC 5322 header block of an email message, including Received chains, Message-ID, Return-Path, and authentication (SPF/DKIM/DMARC) results. It matters for phishing triage, spoofing detection, originating-IP tracing, infrastructure attribution, and campaign clustering.

Format: RFC 5322/5321 header fields; Received: hops with IPs and timestamps (bottom-up), Message-ID '<id@domain>', Authentication-Results with spf=/dkim=/dmarc= verdicts; validate DKIM signature (d=, s= selector) against DNS TXT.

📡 How it is collected

• Exported .eml/.msg from mail clients
• Mail gateway/quarantine captures
• Phishing report submissions
• Honeypot/spamtrap collection
• Header-forwarded abuse reports
• SIEM email log ingestion

📚 Enrichment & validation sources

🔗 Pivot to

🧩 Analysis & hunting techniques

• Received-chain parsing to true originating IP
• SPF/DKIM/DMARC verdict analysis for spoofing
• Message-ID and X-header fingerprinting of sending stack
• Display-name vs Return-Path mismatch detection
• Campaign clustering by header artifacts
• Timezone/locale leakage from Date and Received
• Mailer/MTA identification (X-Mailer, boundary strings)

🔧 Tools

• MXToolbox
• Google Messageheader
• mha (mail header analyzer)
• dkimpy
• Thunderbird source view
• SpamAssassin

⚡ Workbench actions

• Parse Received chain to origin IP
• Validate SPF/DKIM/DMARC
• Extract and detonate embedded URLs
• Fingerprint sending infrastructure
• Cluster with related phishing campaigns
• Screen origin IP against blocklists
• Generate detection/YARA-style rule

📊 Dashboard KPIs

📂 Open