Before
An analyst would likely review the forwarded email, inspect its headers and sender, extract URLs and addresses, and move between separate reputation and malware-analysis tools. They would then compile the findings, determine a verdict, and manually create or update the Jira case with the evidence and any supporting artifacts.
How it works
- Receive the reported email, create an initial Jira case, and enrich the message with header IP and sender information.
- Detect available evidence such as attachments, URLs, email addresses, and domains, then send each relevant item through its configured analysis path.
- Wait for the applicable results, validate the completed analysis, and update Jira with the verdict, detailed findings, and supporting artifacts.
Workflow details
- Email intake and case creation: An email forwarded to the workflow is read and used to create an initial Jira issue containing the reported message details, including its subject, body, and headers. Header IP information is also enriched through an IP reputation and location lookup.
- Conditional evidence analysis: The workflow checks which evidence types are present and follows the relevant paths for attachments, URLs, email addresses, and sender information. Attachments are separated for individual analysis, while URLs and email addresses are extracted from the message content before further investigation.
- Reputation and threat checks: Attachments are submitted for malware analysis, URLs are submitted to URL scanning and reputation services, and the sender or embedded email addresses are assessed for reputation. Extracted domains are also processed through configured domain-resource actions, including a denylist update path.
- Result compilation and validation: The workflow waits for the applicable analyses to return, combines attachment, URL, sender, email, IP, and domain findings, and performs final validation before preparing the case content. Branches for missing evidence allow the workflow to continue without unnecessary analysis steps.
- Analyst-ready case update: The compiled findings are formatted for Jira, including an overall email verdict, the original case context, and the individual analysis results. URL snapshots or related analysis artifacts can also be added to the Jira issue so the analyst can review the evidence in one case record.
What changed
The investigation now starts automatically when an email is forwarded, selects analysis paths based on the evidence found, waits for the relevant results, and presents the consolidated outcome in the Jira case. Analysts receive a structured case for review instead of performing each lookup, handoff, compilation, and case update themselves.
Work removed
Manually reviewing each email, looking up header IP and sender reputation, extracting URLs and email addresses, submitting attachments and URLs for analysis, checking whether evidence is present, compiling results from multiple tools, formatting the investigation summary, and updating the Jira case with findings and artifacts.
Expected outcome
Each reported email is expected to produce a more complete and consistently documented Jira investigation while automating roughly 8–10 recurring lookup, extraction, compilation, and case-update actions; this is a conservative estimate based on the listed workflow stages, not a measured customer result.
