Before
Analysts likely had to inspect each URL or email attachment, switch between internal records and external intelligence sources, wait for reports, and compare detection counts manually. They also had to extract domains or calculate file hashes, update the appropriate allowlist or blocklist, and send the classification back to the originating process.
How it works
- Receive the artifact request and route it into a URL or attachment analysis path.
- Check internal intelligence where applicable, obtain the external analysis, and apply the configured malicious-detection thresholds.
- Update the relevant whitelist or blacklist and return the Boolean classification to the principal workflow.
Workflow details
- Trigger and routing: The workflow starts when an emailhook receives an artifact-analysis request from a principal workflow, decodes the supplied authorization token, and routes the request according to whether the artifact is a URL or an attachment.
- URL analysis: URLs are submitted for external analysis, the workflow waits five seconds for the analysis to complete, retrieves the result, and compares the malicious detection count with a threshold of five. URLs with more than five malicious detections are marked malicious, while URLs with five or fewer detections have their domains extracted and recorded as clean.
- Attachment analysis: For each attachment, the workflow retrieves the file content, calculates its SHA-256 hash, and sends the hash through an internal threat-intelligence check before requesting an external file report when the internal check does not resolve the artifact.
- Threat-list maintenance: Malicious domains and attachment hashes are appended to the corresponding blacklist spreadsheet ranges, while domains and hashes with no qualifying malicious detections are appended to whitelist ranges. This keeps the internal threat-intelligence records aligned with the analysis results.
- Result handoff: The workflow returns a JSON Boolean result to the principal workflow, indicating whether the analyzed URL or attachment was classified as malicious.
What changed
Artifact classification now starts automatically from the principal workflow and follows the same routing, lookup, threshold, and spreadsheet-update logic for every URL or attachment. The human handoff is replaced by an immediate machine-readable result, while the relevant internal list is updated automatically based on the classification.
Work removed
Manually reviewing URLs and attachments one by one, waiting for external analysis reports, extracting domains, downloading attachments, calculating SHA-256 hashes, checking internal intelligence records, comparing malicious-detection counts, copying indicators into whitelist or blacklist spreadsheets, and sending the result back to the originating workflow.
Expected outcome
Each artifact receives a consistent Boolean classification and list update while replacing approximately 4–6 recurring manual checks or handoffs per item, based on the configured workflow stages rather than measured customer results.
