Before
Responders searched for matching messages, reviewed the affected recipients, and handled copy removal separately from sender blocking. They also had to determine whether deletion was necessary when no matching copies were found.
How it works
- Receive the confirmed phishing case and prepare sender, subject, Message-ID, and time-window criteria.
- Search for matching analyzed emails, expand the results to affected recipients, and decide whether copies require remediation.
- Block the sender and either remove the identified copies or return a sender-blocked-only result when no copies are found.
Workflow details
- Trigger and preparation: The workflow starts with a confirmed phishing case containing sender, subject, message identifier, receipt time, and decision information. It builds matching criteria and a seven-day search window, preserving the selected remediation action and decision source.
- Sender protection: The sender-blocking action is applied with a 30-day expiration, ensuring future messages from the confirmed sender are addressed as part of the same response.
- Copy discovery: Graph Security is searched for analyzed emails in the calculated time range. Results are matched by sender or Internet Message-ID, and each matching message is expanded across its recipients to identify the affected copies.
- Conditional remediation: The workflow checks whether any matching copies were found. If copies exist, it submits them for the configured removal action; if none exist, it completes with a sender-blocked-only status instead of attempting unnecessary deletion.
- Operational result: The flow returns the number of remediated copies and a clear status indicating whether the campaign was remediated or only the sender was blocked.
What changed
The sender block, seven-day search, matching logic, recipient expansion, and copy-removal decision now run as one response after a confirmed verdict. Humans or upstream detection processes still provide the confirmed case and decision, while the workflow delivers a standardized remediation status.
Work removed
Repeated searches for matching mail, manual recipient-by-recipient copy selection, separate sender-block requests, and manual checks for whether deletion is necessary.
Expected outcome
One standardized remediation run per confirmed campaign, replacing at least two recurring responder actions—copy investigation or removal and separate sender blocking—when matching copies exist.
