Before
A user or analyst would likely search the mailbox, open the specified email, retrieve and prepare the attachment, and submit it for analysis manually. If the file was malicious, they would then delete the email, look up the recipient in Slack, and compose a warning message.
How it works
- Retrieve the specified email and attachment from the user's mailbox, then convert the attachment into an analyzable file.
- Submit the file for malware analysis, retrieve the verdict, and branch based on whether malware is detected.
- For malicious files, delete the email and notify the associated Slack user; for clean files, complete the operation successfully.
Workflow details
- Mailbox retrieval: The workflow searches the user's mailbox, retrieves the specified email, and obtains its attachment for inspection.
- File preparation: The attachment data is converted from Base64 into binary format so it can be submitted for malware analysis.
- Security analysis: The file is submitted to a malware analysis service, and the workflow retrieves the resulting verdict before making a decision.
- Malware response: If the analysis identifies malware, the related email is deleted from the mailbox, the associated Slack user is located by email address, and a warning message is sent explaining that the suspicious email was removed.
- Clean-file handling: If the analysis does not identify malware, the workflow marks the operation as successful without taking the deletion and notification actions.
What changed
Attachment retrieval, malware screening, verdict-based branching, email deletion, user lookup, and notification now occur in one automated workflow. The malicious-email response is delivered to the associated Slack user after the email is deleted, while clean attachments finish without additional intervention.
Work removed
Searching the mailbox, opening the message, retrieving the attachment, converting its encoding, submitting the file for analysis, checking the verdict, deleting malicious email, looking up the associated Slack user, and composing the warning notification.
Expected outcome
Each processed attachment receives one automated malware decision, and a malicious result triggers three automated response actions: email deletion, user lookup, and Slack notification.
