Before
Security analysts likely had to open each suspicious email, extract sender and URL details, switch between reputation tools, wait for URL results, and assemble the evidence into a report. They also had to notify the security team and manually contact the recipient when a warning was warranted.
How it works
- Extract the email’s sender, recipient, domain, source information, URLs, subject, and full content, then route the message through internal or external sender checks.
- Review sender, domain, and URL reputation data, wait for queued URL analyses, compare malicious findings with the configured threshold, and build the investigation context.
- Post the security assessment to the team with Ignore and Warn actions, update the message with the selected decision, and email the recipient when Warn is approved.
Workflow details
- Email intake and extraction: The workflow starts when an email is forwarded to the email trigger. It extracts the sender, recipient, source IP information, sender domain, URLs, subject, and full email content for investigation.
- Reputation assessment: Internal senders matching the configured internal pattern can be marked safe, while external senders are checked for email reputation and their domains are reviewed for additional reputation details.
- URL investigation: Every URL found in the email is submitted for analysis. The workflow waits for queued results, retrieves the analysis details and statistics, combines the findings, and compares malicious detections against a threshold of more than five.
- Security reporting: The collected email, sender, domain, and URL evidence is provided to an analysis step that creates a structured report with an overall risk assessment and specific recommendations. URLs in the report are rendered as non-browsable links before the report is posted to the security team’s Slack channel.
- Human-approved follow-up: The team receives Ignore and Warn actions. The selected action is recorded in the Slack message, and choosing Warn sends the recipient an email stating that the message was confirmed as phishing and instructing them to contact the SecOps team.
What changed
Each forwarded email now receives an automated first-pass investigation that performs the configured reputation checks, URL analysis, threshold comparison, and report preparation before presenting the result to the security team. Human involvement is retained for the final Ignore or Warn decision, while the selected handoff and any recipient warning are carried out automatically.
Work removed
Opening and reviewing each email manually, extracting sender and URL information, checking sender and domain reputation, submitting URLs and waiting for results, copying findings into a report, posting the report to the security team, and manually sending the recipient warning after approval.
Expected outcome
A consistent investigation report and actionable security-team handoff for each forwarded email, with human approval retained before warning the recipient.
