Before
An analyst likely had to inspect incoming email text, extract links, submit each URL for reputation analysis, and review the results individually. For malicious links, the analyst then had to decide whether a ticket was needed, create the phishing report, and copy the URL and analysis score into a ticket comment.
How it works
- Receive an email and extract each URL or domain from its text.
- Analyze every extracted URL, retrieve its result, and continue only when the malicious score is greater than zero and the URL is associated with the email.
- Conditionally create a phishing report ticket and add a comment containing the malicious URL and its score.
Workflow details
- Email intake and extraction: The workflow starts when an email is received through an email trigger and extracts domains or URLs from the email text for individual analysis.
- URL security analysis: Each extracted URL is submitted for analysis and the resulting report is retrieved before the workflow checks whether the malicious score is greater than zero.
- Malicious-link filtering: URLs that do not receive a malicious result are skipped, while qualifying URLs are transformed into structured items containing the URL and its malicious score.
- Phishing report validation: For each processed item, the workflow checks whether the malicious URL is associated with the email and evaluates whether a service desk ticket should be created.
- Service desk handoff: When the ticket condition is met, the workflow creates a phishing report ticket using the sender's email address, then adds a comment containing the malicious URL and its VirusTotal score.
What changed
URL analysis and malicious-score checks now occur automatically for every extracted link. Qualifying findings are transformed into ticket-ready data and handed to the service desk with the sender, phishing subject, URL, and score, leaving people to handle the resulting report rather than perform the intake and evidence-copying steps.
Work removed
Extracting URLs from emails, submitting and retrieving URL analyses, reviewing malicious scores, checking whether a malicious URL belongs to the email, creating phishing report tickets, and copying URL findings into ticket comments.
Expected outcome
Each qualifying email can produce a documented phishing ticket and evidence comment while automating roughly four recurring analysis and triage actions per email.
