Skip to main content
TrustRadius
Cofense Triage

Cofense Triage

Overview

What is Cofense Triage?

Cofense Triage accelerates phishing qualification, investigation, and response by automating standard responses to suspicious emails to make analysts more efficient and driving out actionable intelligence, and providing incident response playbook.

Read more
Recent Reviews

TrustRadius Insights

Cofense Triage offers a range of valuable use cases for users seeking to improve their email security. With its automated scanning and …
Continue reading

Threat Scope.

10 out of 10
August 06, 2022
Incentivized
The system is great; it really does take the worry away of parsing through emails that may be deemed benign or not. The deployment was …
Continue reading

Simple Yet Effective Tool

9 out of 10
July 05, 2022
We use the product to automatically triage emails reported as phishing. We receive a large number of spam emails. Cofense Triage has saved …
Continue reading

Cofense Triage Review

8 out of 10
March 01, 2022
Incentivized
During these busy IT times, there are more and more phishing emails getting delivered in our environment, Cogence Triage helps to manage …
Continue reading
Read all reviews

Awards

Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards

Popular Features

View all 4 features
  • Centralized Dashboard (35)
    8.0
    80%
  • Live Response for Rapid Remediation (31)
    6.9
    69%
  • Integration with Other Security Systems (34)
    6.7
    67%
  • Attack Chain Visualization (27)
    6.6
    66%

Reviewer Pros & Cons

View all pros & cons
Return to navigation

Pricing

View all pricing
N/A
Unavailable

What is Cofense Triage?

Cofense Triage accelerates phishing qualification, investigation, and response by automating standard responses to suspicious emails to make analysts more efficient and driving out actionable intelligence, and providing incident response playbook.

Entry-level set up fee?

  • Setup fee optional
For the latest information on pricing, visithttps://cofense.com/pricing

Offerings

  • Free Trial
  • Free/Freemium Version
  • Premium Consulting/Integration Services

Would you like us to let the vendor know that you want pricing?

9 people also want pricing

Alternatives Pricing

What is CrowdStrike Falcon?

CrowdStrike offers the Falcon Endpoint Protection suite, an antivirus and endpoint protection system emphasizing threat detection, machine learning malware detection, and signature free updating. Additionally the available Falcon Spotlight module delivers vulnerability assessment with no…

What is KnowBe4 PhishER/PhishER Plus?

PhishER is presented as a lightweight Security Orchestration, Automation and Response (SOAR) platform to orchestrate threat response and manage the high volume of potentially malicious email messages reported by users. And, with automatic prioritization of emails, PhishER helps InfoSec and Security…

Return to navigation

Features

Incident Response Platforms

Incident response (IR) platforms guide countermeasures against a security breach and deploy preplanned, automated threat responses

7
Avg 8.5
Return to navigation

Product Details

What is Cofense Triage?

Cofense Triage is a phishing-specific solution for qualifying, investigating, and responding to phishing attacks. Cofense Triage integrates intelligence-driven rules to reduce the noise generated by a reporting culture and surface those threats that put an organization at risk. Playbooks enable security operations teams and threat analysts to reduce their workload by automating the analysis of and response to known events, freeing up time to investigate the latest threats to the organization. And, with a fully documented API, Cofense Triage integrates with existing security investments, including ticketing systems and SIEM and SOAR platforms.

Cofense Triage Features

Incident Response Platforms Features

  • Supported: Integration with Other Security Systems
  • Supported: Attack Chain Visualization
  • Supported: Centralized Dashboard
  • Supported: Live Response for Rapid Remediation

Additional Features

  • Supported: Extensive & regularly updated rules library to identify emerging & evolving phishing threats
  • Supported: Smart clustering to group reported emails based on threat payload
  • Supported: Noise Reduction Engine to aid classification and processing of non-malicious reported emails
  • Supported: Integration with VirusTotal and other security tools including SIEM & Threat Analysis solutions
  • Supported: Comprehensive API
  • Supported: Create Recipes to automate processing of reported emails
  • Supported: Integrate with Cofense Vision for quick-click phish threat hunting and quarantine
  • Supported: Provide feedback to users who report to support awareness programs
  • Supported: Triage Community Exchange enabling crowdsourced threat intelligence

Cofense Triage Screenshots

Screenshot of Triage DashboardScreenshot of Triage Dashboard Cluster DetailsScreenshot of Triage Cluster DetailsScreenshot of Triage Cluster Malicious AttachmentScreenshot of Triage Cluster HeadersScreenshot of Triage Reporter DetailsScreenshot of Triage Noise Custom Rules

Cofense Triage Video

Cofense Triage

Cofense Triage Integrations

  • VirusTotal
  • SIEM solutions via Syslog
  • Cisco Umbrella Investigate
  • Lastline Analyst
  • Palo Alto Wildfire
  • Cuckoo Sandbox
  • ServiceDesk solutions via Email

Cofense Triage Competitors

Cofense Triage Technical Details

Deployment TypesOn-premise, Software as a Service (SaaS), Cloud, or Web-Based
Operating SystemsWindows, Linux, Mac, Linux virtual appliance
Mobile ApplicationNo
Supported CountriesGlobal
Supported LanguagesEnglish

Cofense Triage Downloadables

Frequently Asked Questions

Cofense Triage accelerates phishing qualification, investigation, and response by automating standard responses to suspicious emails to make analysts more efficient and driving out actionable intelligence, and providing incident response playbook.

Agari Phishing Response, KnowBe4 PhishER/PhishER Plus, and Avanan are common alternatives for Cofense Triage.

Reviewers rate Centralized Dashboard highest, with a score of 8.

The most common users of Cofense Triage are from Enterprises (1,001+ employees).

Cofense Triage Customer Size Distribution

Consumers0%
Small Businesses (1-50 employees)1%
Mid-Size Companies (51-500 employees)13%
Enterprises (more than 500 employees)86%
Return to navigation

Comparisons

View all alternatives
Return to navigation

Reviews and Ratings

(70)

Community Insights

TrustRadius Insights are summaries of user sentiment data from TrustRadius reviews and, when necessary, 3rd-party data sources. Have feedback on this content? Let us know!

Cofense Triage offers a range of valuable use cases for users seeking to improve their email security. With its automated scanning and analysis capabilities, it helps users identify phishing and spam emails, reducing the risk of falling victim to cyberattacks. By integrating a button into the email platform, end users can easily report suspicious emails, increasing user reporting and further enhancing email security. This feature has been well-received by customers, who have praised its effectiveness in identifying malicious emails.

Administrators also benefit from Cofense Triage as they can set up triage and roles for employees, streamlining the process and enabling efficient threat remediation and user education. The software's comprehensive history and analysis of phishing and spamming emails are highly regarded by users as it aids in minimizing the impact of data breaches and assists in creating rules to prevent future phishing attempts.

Users appreciate the customization options provided by Cofense Triage, allowing them to create rules and recipes tailored to their specific requirements. This customization not only enhances their threat hunting skills but also automates responses, saving time and improving efficiency. Additionally, the software's ability to analyze email headers and detect suspicious emails has proven to be a valuable time-saver by presenting important information upfront and reducing the time spent on spam and benign messages.

Cofense Triage stands out with its capability to prioritize the severity of phishing emails, helping users determine which ones require immediate attention. Integration with Cofense Vision allows for quarantining these harmful emails, preventing potential harm to systems. Users have found this collaboration between the two tools particularly useful in efficiently collecting valuable information while protecting against phishing campaigns.

In terms of management capabilities, Cofense Triage excels at aggregating and organizing thousands of suspicious emails reported by employees. This centralization eases analysis processes conducted by security teams, enabling effective decision-making on remediation actions. Analysts also find value in having a centralized portal to review and respond to phishing emails, greatly enhancing their ability to document and protect against phishing campaigns.

The software's effectiveness in identifying various types of phishing attacks, including credential theft, business email compromise, malware, and social engineering, has garnered positive feedback from customers. Its ability to prevent numerous phishing campaigns by providing distinct insights into the types of emails received daily is highly appreciated.

Cofense Triage caters to users seeking efficiency in their email triage process. It allows for automatic categorization of emails and provides predefined responses based on defined criteria, saving time and improving overall productivity.

Managed service providers also find value in Cofense Triage as it enables them to efficiently triage reported emails and provide analysis for their clients. This streamlines the triage process and supports the analysis of targeted campaigns, ultimately improving the overall efficiency of their operations.

Overall, Cofense Triage serves as a reliable email security solution for both end users and administrators. By automating the scanning, analysis, and blocking of malicious emails, it helps users identify and prevent phishing and spam attacks. The software's customizable rules and recipes enhance threat hunting capabilities, while its detailed history and analysis of phishing emails aid in minimizing data breaches. With its seamless integration with the email platform and ability to prioritize severity, Cofense Triage streamlines the triage process and empowers organizations to effectively respond to phishing threats.

Attribute Ratings

Reviews

(1-8 of 8)
Companies can't remove reviews or game the system. Here's why
Score 9 out of 10
Vetted Review
Verified User
Incentivized
Triage has been very helpful with remediating phishing emails that hit our employees mailboxes. We are able to use the provided and customized rules to filter out legitimate emails which help our investigators save time by looking at high fidelity alerts. The simplicity of the product is also great for our end users which enables them easy access to report suspected phishing emails.
  • Email Reporting
  • customization
  • playbooks
  • updates
  • maintenance
Cofense Triage has been great for our end users as well as our engineers and investigators. We are able to streamline phishing reports and investigate and respond in a timely manner. This allows us to stay vigilant against phishing techniques while providing a great user experience. Utilizing the provided and customizable rules allows for easy integration to existing workflows and products.
Score 8 out of 10
Vetted Review
Verified User
We run Cofense Triage as an MSSP, offering as part of a managed service to our clients. We provide the analysts who Triage the reported emails, make decisions on their authenticity and malicious intent. Our analysts then provide feedback to the reporter and we summarize details of the overall Triage service on a regular basis. We use Triage in conjunction with Vision to provide an overall email security service.
  • Risk rating emails using rules.
  • Scoring reporters based on their performance at reporting malicious vs non-malicious emails.
  • Previews and rating attachments.
  • Integrations using APIs to allow quicker analysis of URLs.
  • Adding additional mailboxes which can be customised for different analysts or rules to prioritise a 'Suspected Malicious' mailbox over a 'Suspected Spam' etc. mailbox.
  • Recipies and Triggers appear to be an overlap and 2 features which do the same thing.
  • Showing comments made on a cluster in the mailbox view can often help save time, rather than entering the contents of a message to see this information.
  • Automatic comments on messages based on a playbook would be useful, this may be a feature that exists on new versions however.
Triage is an excellent solution for analyzing, categorizing and responding to reported emails. It has a simple interface which is easy to get used to and the features can be used to semi-automate many actions, speeding up the analysis massively. This is a great platform for analyzing small to medium amount of emails (10-20 per analyst per day), however it takes quite a lot of setup of automation to make it useful for larger scale companies.
Score 4 out of 10
Vetted Review
Verified User
Incentivized
Cofense Triage is used across our entire organization. Any emails that our users believe to be phishing or malicious can be reported using the report phishing toolbar button, and then our security operations center reviews the email in Triage and responds to the user letting them know if it is safe, spam, or malicious. Triage allows users to easily report the emails, and also clusters them together, and provides tools to more quickly analyze the emails to determine if they are malicious. The plugin has some issues and limitations where it is not always available to users, so some users still opt to forward the email to our phishing mailbox instead of using Triage
  • Separating links and attachments contained in the email, and checking to see if they are known malicious.
  • Clustering like emails to save time when responding.
  • Providing risks scores with each cluster to give an estimate on which clusters should be addressed first.
  • plugin regularly disappears from outlook and is not available on all mobile platforms
  • UI updates tend to make the Triage page look nicer at first glance, but have often caused it to be more clunky and harder to use.
  • Lacks some features such as being able to send one off responses to submitted emails instead of just canned responses.
Cofense does a fine job of classifying emails and responding to users. Set up is straightforward, and Triage is easy to use. It does not have the best quarantine features and does not offer as many proactive ways to defend against future attacks as other solutions. Other solutions are cheaper, have better integrations into the email gateway, and offer more features, such as training modules for users that regularly submit safe emails.
August 15, 2021

Cofense Triage Review

Score 9 out of 10
Vetted Review
Verified User
Incentivized
We are using Triage to analyze the user-reported emails through the PhishMe button. Triage helps to segregate the emails of our organization. In normal cases, analyzing mails by .eml is difficult. There is a good chance we might miss some URL or header with malicious mail. Using Triage makes it very easy, and also it has solutions like writing YARA rules, drafting responses, and giving tags to suspicious emails. All of these features are very useful.
  • Triage has the option to write YARA through which we can auto categorize mail.
  • Triage has the option to tag emails.
  • Triage has options to check for other similar emails reported by users.
  • Triage has the option to check the score of the reporter through which we can educate users.
  • I have seen in a recent update additional tags suggestions are not shown, so fixing that would help.
  • It would be easy for analysts working on email if they get highlighted IOCs to see.
  • Sometimes emails do not render properly, and attachments are missed for a few emails, so having less of this kind of issue would be great.
It makes analysts' jobs easy. Using Triage will help to reduce the mistakes while analyzing the suspicious emails reported by organization users. Also, it gives calculated Hash values which solve half the problem with malicious files, headers, mail body, URLs, and files that have different sections to analyze, which makes it an awesome tool.
Score 8 out of 10
Vetted Review
Verified User
Incentivized
Cofense Triage is used by the InfoSec team specifically in the Security Operations Center (SOC) to analyze emails reported by employees company-wide when a user suspects an email is malicious or are simply unsure about the content in an email (links, attachments, etc.). The SOC receives these emails in a format which is pre-parsed by Cofense Triage separating the text, HTML, headers, Mail Exchange (MX) records, URLs, and attachments contained within an email. This application allows the SMC an effective way to investigate suspected emails company-wide and provide easy ticketing and tracking. This application addresses the primary entry-point often attempted by malicious actors through phishing and fraud.
  • Parsing email content into a logically organized format
  • Organizing reports
  • Creating tickets in third-party application
  • Responsive support team
  • Large amount of community YARA rule contributions
  • With most update roll-outs, there are often new bugs introduced which affect functionality of the application. I.e. Trouble with categorizing or sending reports, parsing reports, or issues with YARA rules.
  • Cofense Reporter (Report Phishing button) commonly runs into issues where users are unable to report messages as phishing and automatically include email headers.
  • Cofense Reporter does not work well with Shared Mailboxes by default.
  • Report Clusters (grouped emails showing to match similar content) are not very accurate and often emails matching the same content and sender are not grouped together in a cluster.
Cofense Triage is primarily suited for Security Operation Centers (SOC) and departments which are responsible for incident response. This application is designed primarily for this use case and does not offer support for many other use-cases. It fulfills a very specific need which is Information Security and identifying phishing and other threats received through email.
July 27, 2021

Triage

Score 6 out of 10
Vetted Review
Verified User
Incentivized
Cofense Triage is used to parse and examine user reported phishing and determine the appropriate actions as in remediating active campaigns, blocking senders and domains, and making sure our team members are not vulnerable to further attacks by leveraging artifacts in the email header and body. Rules and recipes are created to reduce noise.
  • Easy to read parsed email
  • Easy to navigate tabs in email view
  • Good options for correlating and grouping based on indicators
  • Keyboard shortcuts nonexistent
  • APIs are lacking across the board and updates to APIs are too slow
  • Should be easier to move from one report to another
Good for general phishing email report investigation and tracking of threat indicators, but APIs are very much lacking for integration with SIEM/SOAR products that is vital to a mature security operations. Some elements of UI are unforgivably clunky. Does not play nicely with dark mode, causing analysts to go blind.
Score 10 out of 10
Vetted Review
Verified User
Incentivized
Cofense Triage is used by our organization on a daily basis. This application aggregates and organizes thousands of suspicious emails that are reported by employees. Our security team uses Triage to analyze the reported emails and decide which ones require remediation. We commonly see phishing attacks that contain credential theft, business email compromise, malware, and social engineering. With Triage, our security team is able to see widespread phishing campaigns as well as spear phishing campaigns. Triage provides an advantage to our organization by allowing us to see real time phishing and respond accordingly.
  • Triage provides real time data.
  • Provides actionable intelligence.
  • Provides information critical to remediating phishing attacks.
  • Triage is constantly improved/updated, happy with the product thus far.
Triage does a great job at aggregating reported phishing emails and allowing our security team to remediate the threat while notifying users that we processed their report.
Score 10 out of 10
Vetted Review
Verified User
Incentivized
Cofense Triage allows us to manage our reported phishing emails. The application brings important information to the surface for quick analysis. Analysts can then begin to investigate the email to determine if it is malicious or not. Users of the tool can also create rules that will automatically categorize reported emails. This means that once an email is reported, a rule can be created which will automatically categorize future reports and send a response to end-users. This tool saves me so much time. It truly does help me 'triage' the phishing queue.
  • Automatic categorization
  • Automatic responses
  • Makes analysis easier
  • UI has been updated so that fewer clicks are needed.
Cofense Triage is well suited for an environment where employees have been trained to report suspected phishing emails. If they start doing this, it will be easy for analysts to get inundated with emails that need to be investigated. Triage helps to group similar reported emails and those groups can all be dealt with at once.
Return to navigation