Before
Analysts likely had to open each reported email, identify the sender, extract links, and inspect attachments manually. They then had to move between reputation and scanning services, wait for URL or file results, compile the findings, and notify the security team separately.
How it works
- Receive a reported non-internal email and extract its sender addresses, URLs, and attachments.
- Check sender reputation, scan each URL, and retrieve or generate attachment analysis results while reusing existing file reports when available.
- Have an AI agent assess whether security involvement is required, then post the formatted assessment to Slack.
Workflow details
- Intake and filtering: The workflow starts when a reported email is received through the email trigger. It checks whether the message is internal; internal messages follow a success path, while other messages continue to automated phishing analysis.
- Message extraction: For emails requiring analysis, the workflow identifies sender addresses, extracts unique URLs from the HTML content, and collects attachment details and file content for further review.
- Sender and URL analysis: Each sender address is checked for reputation information. Every extracted URL is submitted for public scanning, the workflow waits 60 seconds after a successful submission, and then retrieves the scan result to record whether the URL is classified as malicious.
- Attachment analysis: Each attachment is checked for an existing analysis report. If no report is available, the file is uploaded for analysis and the resulting report is retrieved; existing reports are reused when available, and the attachment reputation result is formatted for the final assessment.
- Decision and notification: An AI agent reviews the sender, URL, and attachment findings to determine whether security involvement is required and generates the assessment details. The resulting phishing analysis is then posted to a Slack channel so the security team can review and act on it.
What changed
Each eligible reported email is automatically decomposed and enriched across sender, URL, and attachment checks before an AI recommendation is generated. The completed assessment is delivered to Slack as a structured handoff, leaving responders to review the recommendation and take any necessary action.
Work removed
Manually reviewing reported emails, extracting sender addresses and URLs, checking sender reputation, submitting and revisiting URL scans, uploading attachments, looking up file reports, compiling findings, and notifying the security team.
Expected outcome
For emails containing URLs and attachments, the workflow can remove roughly 5–7 recurring analyst actions per message, depending on the number of items requiring analysis, while consistently delivering a consolidated security assessment to Slack.
