Before
Security teams likely depended on employees reporting suspicious emails before manually investigating them. Analysts had to check sender reputation, extract URLs, review attachments across separate tools, decide whether to delete the message, and notify the team.
How it works
- Receive each new email, retrieve its headers and content, and inspect the sender, embedded URLs, and attachments.
- Compare sender and content indicators with blacklist and threat-intelligence results, applying the configured maliciousness thresholds.
- Delete confirmed malicious messages automatically, notify the security team in Teams, and leave approval of a broader mailbox scan to a human.
Workflow details
- Trigger and message retrieval: An incoming Exchange webhook starts the workflow when an employee receives an email. The automation extracts the recipient and message identifiers, retrieves the full message and its internet headers, and immediately acknowledges the webhook event.
- Sender and content analysis: The workflow checks the sender’s mail-server IP against blacklist data, extracts URLs from the message body, and submits each URL for threat-intelligence analysis. Messages with attachments are also retrieved, and each attachment is decoded and analyzed for malicious findings.
- Automated decisions: Sender reputation, URL intelligence, and attachment-analysis results are evaluated through conditional checks. A URL is treated as malicious when the analysis reports at least two related threat pulses, while an attachment is treated as malicious when the analysis reports a nonzero malicious count; blacklist findings are also used as evidence for the malicious-email decision.
- Containment and notification: When a malicious indicator is confirmed, the message is deleted from the recipient’s mailbox without waiting for analyst approval. The security team then receives a Teams notification containing the recipient, sender, receipt time, identified indicator, and an action to initiate a scan of other employee mailboxes.
- Clean-message handling: If the checks do not identify a malicious sender, URL, or attachment, the workflow returns a clean result containing the recipient, sender, and received time. This creates a consistent disposition for every monitored email while reserving broader mailbox scanning for human approval.
What changed
Malicious-email checks, message deletion, and initial team notification now occur automatically when a monitored email arrives. The human handoff moves from confirming and containing the individual message to deciding whether the identified indicator warrants a broader mailbox scan.
Work removed
Opening multiple threat-intelligence tools, checking sender IP reputation, extracting and submitting URLs, decoding and uploading attachments, reviewing analysis results, coordinating message deletion, and manually composing the security notification.
Expected outcome
The workflow note estimates that approximately 10–15 recurring manual actions can be removed per incident, with consistent detection and containment for each monitored employee email.
