Before
An analyst likely had to parse the email manually, identify senders, URLs, and attachment hashes, and copy each indicator into separate reputation and threat-intelligence lookups. The analyst then had to collect the results into a report and email the findings to the requester.
How it works
- Parse the submitted email and extract sender addresses, URLs, and attachments.
- Check sender reputation, scan URLs when present, and search attachment hashes when attachments are available.
- Combine the findings into a formatted report and email it to the requester.
Workflow details
- Email parsing: The workflow receives an email analysis request, parses the EML content, and extracts email addresses for sender reputation checking.
- Sender assessment: Extracted sender addresses are checked through EmailRep.io, and the resulting reputation information is formatted for inclusion in the final analysis.
- URL investigation: When URLs are present, they are extracted and submitted for URL scanning, followed by retrieval of detailed scan results. If no URLs are found, the workflow bypasses this branch.
- Attachment investigation: When attachments are present, the workflow expands and extracts them, searches their file hashes in VirusTotal, and builds the resulting findings. If attachments are absent, the attachment analysis branch is skipped.
- Report delivery: Results from the sender, URL, and attachment checks are assembled into a formatted table and delivered by email to the configured requester.
What changed
Email analysis now follows a single automated path that performs the relevant sender, URL, and attachment checks based on the content detected. Results are assembled and delivered by email without requiring an analyst to switch between lookup services or prepare the final report manually.
Work removed
Manually parsing EML content, extracting sender addresses and indicators, copying URLs and file hashes into lookup services, checking whether URLs or attachments require separate analysis, consolidating investigation results, formatting the report, and emailing the requester.
Expected outcome
For an email containing both URLs and attachments, one run can consolidate three recurring investigation checks into a single emailed report, conservatively removing at least three manual lookup actions per review.
