Before
An analyst likely had to open the reported message, look up its case and attachment details, retrieve and download the file, unpack it, and identify the relevant file information. The analyst then had to move to a separate malware-analysis service to search the attachment hash and assemble the triage context.
How it works
- A reported-message event triggers the workflow, which retrieves the associated case and message details and waits for the message-processing job to finish.
- The workflow identifies the attachment, downloads and unpacks it, then collects the file details needed for analysis.
- It searches the attachment's file hash in VirusTotal and returns the resulting security-enrichment data with the collected triage information.
Workflow details
- Event intake: A reported-message event received through the webhook or emailhook starts the workflow and provides the identifiers needed to locate the related case, message, and attachment.
- Message and case retrieval: The workflow retrieves case message details, waits for the asynchronous processing job to complete, and extracts the message identifier and date required for subsequent lookups.
- Attachment collection: It identifies the attachment asset, retrieves the attachment from the secured message store, downloads it, and unpacks it for inspection.
- Triage preparation: The workflow collects details about the extracted attachment and prepares the information needed for file-based security analysis.
- Security enrichment: It searches VirusTotal using the attachment's file hash and produces a combined triage result. No human approval or notification step is defined in the workflow.
What changed
Attachment retrieval, unpacking, triage-data preparation, and file-hash lookup now happen automatically after a report is received. The resulting analysis context is available at the end of the workflow without a defined manual handoff or notification step.
Work removed
Opening reported messages one by one, retrieving case and attachment details, downloading and unzipping attachments, extracting file details, and manually switching to VirusTotal to search each file hash.
Expected outcome
For each reported message, the workflow removes at least five recurring retrieval and preparation actions from the analyst's process while consistently producing a VirusTotal-enriched attachment triage result.
