Before
Security staff would likely review forwarded emails individually, inspect headers to find the sender IP, switch between reputation services, and extract and check URLs one by one. They would then determine whether the message required escalation, notify the security team, and locate and remove the message from the recipient mailbox.
How it works
- Receive a forwarded external email, extract the sender IP and embedded URLs, and route the IP to the appropriate reputation check.
- Compare IP and URL analysis results with the configured malicious and clean criteria, including VirusTotal, AbuseIPDB, and URLScan verdicts.
- For malicious findings, locate and contain the email when confirmed, then send the security team a contextual notification with the relevant evidence.
Workflow details
- Email intake and filtering: The workflow starts when an email is forwarded to its dedicated email trigger and checks whether the sender is external before continuing with security analysis.
- Sender IP assessment: It extracts the sender IP from the email headers, distinguishes IPv4 from IPv6, and checks the address reputation using AbuseIPDB or VirusTotal. Reputation results are evaluated against configured malicious and clean thresholds.
- URL investigation: When the message contains URLs, the workflow extracts each one and submits it to VirusTotal and URLScan. It waits for the analysis results, retrieves the verdicts, and records whether the URL is considered malicious.
- Containment decision: When the sender IP or embedded URLs meet the malicious criteria, the workflow can authenticate to the recipient mailbox, locate the corresponding message, confirm its identity, and move it to the trash.
- Security notification: The workflow sends a contextual alert to the security team containing relevant information such as the recipient, sender IP or message identifier, date, and URL analysis results. Messages without malicious indicators complete without a containment alert.
What changed
Email triage now begins automatically when a forwarded message arrives. IP format handling, reputation checks, URL extraction, multi-service analysis, threshold evaluation, mailbox containment, and contextual notification are performed by the workflow, leaving people to review the resulting alert rather than coordinate each investigative step.
Work removed
Manually reviewing forwarded emails, extracting sender IP addresses and URLs, switching between IP and URL reputation tools, waiting for URL analysis results, comparing verdicts with malicious thresholds, locating the matching mailbox message, moving it to trash, and composing security-team alerts.
Expected outcome
Each URL-bearing email can receive two automated URL reputation lookups, reducing tool switching and producing a consistent containment and escalation path for messages that meet the malicious criteria.
