Before
Security staff likely had to review sent-mail events individually, decode or open message details, inspect recipients and attachment sizes, and compare recent activity against hourly thresholds. They also had to record the evidence in the user's spreadsheet, notify the team, and coordinate any session termination or suspension manually.
How it works
- Capture new sent-message activity, recover the user's mailbox history state, decode the message, and record its key details in the user's spreadsheet.
- Check for external recipients and large messages, then count qualifying activity from the previous hour and calculate the combined outbound size against the 10 MB threshold.
- Send a reviewable Slack incident and execute the analyst's selected containment or closure action, updating the incident with the result.
Workflow details
- Event capture and state tracking: An email event starts the workflow with encoded sent-message data. The flow retrieves the user's stored mailbox history state, fetches new SENT mailbox changes, and updates the stored history identifier so subsequent runs can continue from the latest point.
- Message enrichment: Each new message is retrieved and decoded, then its sender address, recipient, subject, date, total size, snippet, and attachment details are extracted. These details are appended to the user's dedicated spreadsheet for investigation and audit context.
- Exfiltration screening: The workflow checks whether the recipient is outside the organization and whether the message is at least 1 MB. For qualifying activity, it reviews the user's messages from the previous hour, counts the messages, and calculates their combined size.
- Threshold-based alerting: When the recent outbound messages total at least 10 MB, the workflow creates a Slack incident message containing the user, recipient, subject, message size, message count, total size, and a link placeholder for the user's recorded details. The message includes analyst action buttons rather than applying every remediation automatically.
- Analyst-directed response: Based on the selected Slack action, the workflow can sign the user out of active sessions, reset sign-in cookies, suspend the user, or close the incident as reviewed. It then updates the incident message to reflect the selected outcome and marks the execution complete.
What changed
Each new sent-message event is now enriched, logged, and screened automatically before an analyst is notified. The workflow performs the external-recipient, message-size, hourly-count, and total-size checks consistently, while the human decision is reduced to selecting the appropriate Slack action for containment or incident closure.
Work removed
Manually checking new sent-mail events, retrieving and decoding messages, inspecting recipients and attachment sizes, counting recent messages, calculating hourly totals, copying evidence into the user's spreadsheet, notifying the response team, and coordinating sign-out or suspension actions.
Expected outcome
Each qualifying event can remove an estimated 5–7 repetitive lookup, calculation, logging, and notification actions from the response process; this is a conservative estimate rather than a measured customer result.
