Before
Security staff likely had to open incoming emails, extract attachments, and check each file individually using a separate analysis service. They then had to determine whether a file was malicious, create an incident record, notify the security team, and compile the analysis details themselves.
How it works
- Receive the email and extract all of its attachments for individual processing.
- Analyze each attachment and automatically evaluate whether the file is malicious.
- For a malicious result, create an incident issue, notify the security team, and generate the analysis report; otherwise, complete the workflow successfully.
Workflow details
- Email intake and preparation: The workflow starts when an email is received and extracts its attachments so each file can be handled individually rather than reviewing the message manually.
- Attachment analysis: The automation iterates through every extracted attachment and retrieves its file analysis to determine whether the file is malicious.
- Incident handling: When an attachment is identified as malicious, the workflow creates an issue for tracking and sends a message to the security team with the relevant alert details.
- Reporting and completion: The workflow creates a report containing the analysis details for each attachment. If no malicious file is found, the workflow follows the successful completion path without opening an incident.
What changed
Attachment screening and the malicious-file decision now occur automatically after email receipt. Confirmed malicious files are routed directly into an incident issue and a security-team alert, while clean processing ends through the success path.
Work removed
Manually extracting attachments, checking each file’s analysis, reviewing the malicious-file result, creating incident issues, notifying the security team, and compiling analysis reports.
Expected outcome
Every attachment in an incoming email receives an automated malware check, with malicious findings consistently routed for tracking and security-team review.
