Before
Analysts likely had to open internal reference lists, search for each artifact manually, extract email or URL domains, and calculate or compare attachment hashes. They then had to decide which values were trusted and relay the assessment or suspicious URLs back to the principal analysis process.
How it works
- Receive an artifact-analysis webhook and load the relevant internal email, domain, URL, or attachment reference list.
- Route the request by artifact type, then automatically extract domains, hash attachments, compare values, or filter URLs against the trusted data.
- Return the Boolean assessment or remaining non-trusted URL list to the calling workflow as a JSON response.
Workflow details
- Webhook intake: The workflow receives a TLS-protected webhook from a principal analysis flow containing an artifact type and the value to evaluate, such as an email address, attachment, domain, or URL list.
- Reference data loading: It retrieves the relevant internal reference values from spreadsheet-based lists, including email, domain, URL, and attachment hash entries, then flattens the returned data for comparison.
- Type-specific checks: A decision step routes each request to the appropriate branch. The email branch extracts the email domain and checks it against trusted values, the attachment branch hashes the submitted file and tests whether the resulting hash is listed, and the domain branch compares URL hostnames and base domains with approved values.
- Filtering and response: Email and attachment checks return a Boolean result, while the URL and domain branch filters out trusted URLs and returns the remaining non-trusted URLs. Each result is delivered as a JSON webhook response to the calling flow.
- Operational result: The process replaces repeated artifact lookups, parsing, hashing, comparison, and result handoffs with a consistent automated enrichment step that uses the reference data available at execution time.
What changed
Artifact enrichment now starts from the incoming webhook and completes through an automated type-specific branch. The relevant list lookup and comparison happen before the result is handed back, leaving the principal workflow to consume a standardized assessment or filtered URL list instead of waiting for a manual analyst response.
Work removed
Opening reference lists, searching whitelist values, extracting email and URL domains, hashing attachments, comparing hashes or domains, filtering trusted URLs, and manually returning the result to the calling workflow.
Expected outcome
Each webhook can replace one manual lookup-and-comparison sequence, removing up to three distinct recurring sequences across the supported email, attachment, and domain or URL analysis paths.
