Before
Recipients likely had to open incoming emails, review the headers and body, identify details such as the source IP and attachment status, and manually summarize the information for a team channel. Responding to the sender or opening the relevant playbook also required separate actions from the notification.
How it works
- Capture each incoming email and extract its sender, subject, timing, recipients, message ID, body, attachment status, and source IP.
- Format the extracted information into a structured alert with direct links for investigation and reply actions.
- Post the alert to a configured channel for team review and follow-up.
Workflow details
- Email intake: The workflow starts when an email is received through the email hook, capturing the sender, subject, recipients, message date, message identifier, body, and attachment information.
- Data extraction: It identifies the source IP by searching the received-email header for an IPv4 address and determines whether the message includes attachments.
- Content preparation: The email body is escaped for safe inclusion in the notification, while the extracted fields are assembled into a consistent message format.
- Actionable alert creation: The workflow builds a structured channel message containing the sender, subject, time, source IP, attachment status, message ID, and email body, plus links to open the playbook and create a reply to the sender.
- Channel delivery: The completed notification is posted to a configured channel so recipients can review the email context and decide whether to investigate further or respond.
What changed
Each incoming email now produces a consistently formatted channel alert with key context and follow-up links automatically. Human recipients still decide whether to open the playbook or respond, but the data gathering and notification handoff happen without manual reformatting.
Work removed
Manually opening each email to collect header and message details, checking whether attachments are present, identifying the source IP, copying the email body into a team update, formatting the notification, and manually creating reply or playbook links.
Expected outcome
One structured, actionable alert is created per incoming email, removing the recurring manual preparation and channel-posting steps while preserving human control over investigation and response.
