Before
An analyst would likely open the reported event, check the related case and job status, and retrieve the message details manually. They would then identify, download, and unpack the attachment before looking up its file hash for further triage.
How it works
- Receive the Material Security event, retrieve the related case and job results, and extract the reported message context.
- Identify the attachment, download it, unpack it, and collect the relevant triage details.
- Search the attachment file hash in VirusTotal and return the resulting lookup data with the collected context.
Workflow details
- Event and case retrieval: The workflow begins when a Material Security event provides an asset identifier. It retrieves the related case status and waits 10 seconds before collecting the available job results.
- Message reconstruction: It extracts the reported message identifier and date, then retrieves the message details needed to identify the relevant attachment.
- Attachment handling: The workflow gathers attachment identifiers and filenames, downloads the attachment from Material Security, and unpacks it for further analysis.
- Triage preparation: It collects the resulting attachment information into triage data, preserving the details needed for the final file assessment.
- Hash-based lookup: The attachment file hash is submitted to VirusTotal for a lookup, giving the triage process an external file-analysis result alongside the collected message and attachment context.
What changed
A reported event now starts a sequential triage process that performs the case, message, attachment, file-handling, and hash-lookup steps automatically. The workflow delivers the collected context and lookup result without showing a separate human approval step.
Work removed
Opening each reported event, checking case and job status, extracting message and attachment identifiers, downloading and unpacking attachments, assembling triage details, and submitting file hashes for lookup.
Expected outcome
For each event, roughly 5–7 recurring retrieval, file-handling, and lookup actions can be replaced by one repeatable automated sequence; this is a conservative estimate based on the configured steps, not a measured customer result.
