Before
Security staff likely had to review new external email notifications, compare mailbox state, retrieve messages, and inspect senders, headers, links, and attachments manually. They also had to switch between email tools, allowlists, blocklists, threat intelligence sources, and internal records before documenting a finding and removing a malicious message.
How it works
- Receive a mailbox event, compare it with the stored mailbox state, reject duplicates, and retrieve the new message.
- Route internal and external mail differently, then check external sender details, headers, domains, URLs, message parts, and attachments against configured lists and threat intelligence sources.
- Record the analysis, update internal intelligence records, and automatically move messages with confirmed malicious indicators to the trash.
Workflow details
- Event and state tracking: A mailbox notification starts the workflow with the user's mailbox information and history position. The flow compares that position with the last stored state, ignores duplicate events, and records the initial state when no prior history exists.
- Message retrieval and routing: For a new message, the workflow obtains the required mailbox access, retrieves the email, and stops analysis for messages identified as internal. External messages continue through sender, header, and delivery-path checks, including handling messages delivered through group lists.
- Sender and domain triage: Relevant sender, subject, date, source-IP, and authentication-related header information is extracted. Sender addresses and message URLs are checked against maintained allowlists, blocklists, and internal threat intelligence data before deeper inspection continues.
- Content and artifact analysis: The workflow evaluates message structure and MIME types, decodes supported text and HTML content, extracts URLs, and submits URLs and supported attachments for threat intelligence analysis. It processes multipart messages and includes common text, HTML, image, PDF, calendar, and attachment formats.
- Automated response and learning: Analysis results are stored and used to update internal databases. When a URL, attachment, or other analyzed artifact is identified as an indicator of compromise, the targeted email is automatically moved to the user's trash without a human approval step shown in the workflow.
What changed
Each qualifying mailbox event now initiates the full analysis sequence automatically, including state validation, artifact extraction, threat intelligence checks, result recording, and malicious-message removal. Human analysts are no longer required to perform the initial inspection or approve the trash action shown in the workflow.
Work removed
Manually checking mailbox history and duplicate events, retrieving messages, reviewing sender and header details, decoding message parts, extracting URLs, inspecting attachments, consulting allowlists, blocklists, and threat intelligence sources, recording results, and moving confirmed malicious emails to Trash.
Expected outcome
Conservatively, the workflow removes at least four recurring manual checks or actions for each processed external email and provides an automated containment path for messages whose artifacts are identified as malicious.
