Before
Security staff likely had to open forwarded emails, inspect headers and message content, extract sender IPs and links, and submit those indicators for reputation checks. They also had to review attachment results, locate the original mailbox message, move malicious mail to trash, and compose a notification with the relevant evidence.
How it works
- A forwarded email triggers the workflow, which identifies the corresponding mailbox message and extracts the sender IP, body URLs, and attachments.
- The workflow checks the sender IP, qualifying URLs, and attachment reports, applying reputation-based conditions to determine whether any indicator is malicious.
- When a malicious condition is met, the target message is moved to trash and the security team receives a contextual Slack alert; otherwise, the available findings are recorded as clear or non-malicious results.
Workflow details
- Email intake and message identification: The workflow starts when an email is forwarded to the flow emailhook. It extracts the recipient, sender, message ID, message date, message text, received-SPF information, URLs, and attachments, then uses mailbox access to locate and verify the corresponding message.
- Sender IP investigation: The flow extracts the sending IP address from the email headers and determines whether it is IPv4 or IPv6. It submits the address to reputation services and evaluates the returned abuse or malicious indicators to determine whether the sender infrastructure should be treated as suspicious.
- URL investigation: URLs are extracted from the email body and evaluated individually, while Google Docs links are excluded by a workflow condition. Each remaining URL is submitted for analysis, the workflow waits for the result, retrieves the report, and records whether malicious detections were returned.
- Attachment investigation: When attachments are present, the workflow reviews each attachment using its checksum and records the available analysis result. Attachment findings are combined with the other investigation results to determine whether the message requires containment and escalation.
- Containment and notification: When a malicious IP, URL, or attachment condition is met, the matching mailbox message is moved to trash and the security team receives a contextual Slack notification containing details such as the recipient, sender, message ID, date, sender IP, and analysis results.
What changed
Email analysis now starts automatically when a message is forwarded and the IP, URL, and attachment checks run through defined branches without manual tool changes or copying of indicators. Suspicious messages are automatically moved to trash and the security team receives the investigation context in Slack, with no human approval step shown in the workflow.
Work removed
Opening forwarded emails one by one, extracting sender IPs and URLs, submitting indicators for reputation checks, reviewing attachment reports, matching the forwarded message to the mailbox copy, moving malicious messages to trash, and manually composing security notifications.
Expected outcome
Consistent per-message phishing screening with automated containment and contextual security escalation for emails that meet the configured malicious conditions.
