Before
An analyst would manually inspect email headers, identify relevant IPv4 and IPv6 addresses, and switch between separate services to check reputation and geographic information. They would then locate SPF, DKIM, and DMARC results and copy the findings into a consolidated summary for investigation.
How it works
- Extract IP addresses from the submitted email headers and begin reputation and location lookups.
- Check the available authentication results and capture SPF, DKIM, and DMARC values.
- Combine the IP, reputation, geographic, spam-activity, and authentication findings into a structured analysis result.
Workflow details
- Header analysis: The workflow processes supplied email header content and extracts IPv4 and IPv6 addresses for investigation.
- IP reputation review: Each extracted IP is submitted for reputation analysis, allowing the workflow to capture available indicators such as recent spam activity and sender reputation.
- Location enrichment: The IP addresses are geolocated to associate them with an organization, country, and city when that information is available.
- Authentication check: The workflow checks whether email authentication results are available and extracts SPF, DKIM, and DMARC values from the header data.
- Structured findings: Reputation, location, authentication, and initial-IP details are assembled into a consistent result for reviewing potential spoofing or suspicious email activity.
What changed
Email header analysis now follows a repeatable workflow that performs IP extraction, reputation and location checks, authentication review, and result formatting in one sequence. The analyst receives consolidated investigation context instead of manually coordinating each lookup and assembling the findings.
Work removed
Manually scanning headers for IP addresses, performing separate reputation and geolocation lookups, checking authentication headers, and copying findings into a formatted investigation summary.
Expected outcome
The workflow is expected to remove the recurring manual extraction and cross-tool lookup sequence for each submitted header set, producing one consolidated analysis without a justified time-based performance estimate.
