Item: Cofense Triage
Rating: 7
Author: Verified User

Use Cases and Deployment Scope

For my role, my team uses Cofense Triage to group email campaigns for phishing investigation and responding to users.

Pros and Cons

Cluster email reports from users.
Respond to users.
Whitelist known benign emails.

I would not consider Cofense Triage a full IR/investigation tool. The reporting is limited; you can't have analysts assign clusters like queues and cannot categorize outcomes. For instance, if you categorize something as credential theft you cannot add notes or anything indicating whether that attempt was successful.

Return on Investment

Big time savings from whitelisting known benign emails.
Big time savings from TNR rules.

Key Insights

Do you think Cofense Triage delivers good value for the price?

Not sure

Are you happy with Cofense Triage's feature set?

Yes

Did Cofense Triage live up to sales and marketing promises?

I wasn't involved with the selection/purchase process

Did implementation of Cofense Triage go as expected?

I wasn't involved with the implementation phase

Would you buy Cofense Triage again?

Yes

You need to have a separate tracking or ticketing system due to limitations as to making notes on reports and closing. But for clustering and campaign identification/response and whitelisting it works well.

Cofense Triage operator review

Overall Satisfaction with Cofense Triage