Before
Analysts had to review each reported email from scratch, decide whether additional indicator checks were needed, and assemble the case record manually. Uncertain reports also required separate coordination for evidence review, analyst decisions, reporter communication, and remediation handoff.
How it works
- Receive the parsed report, build a normalized case, and perform an initial whole-email assessment with allowlist and consistency checks.
- Skip enrichment for only high-confidence legitimate reports; otherwise verify relevant indicators and route high-confidence or uncertain results through the configured confidence rules and analyst review.
- Record the disposition in Jira, prepare the reporter message, and invoke automatic or analyst-approved remediation when phishing is confirmed.
Workflow details
- Case preparation: The flow receives a parsed email report, normalizes sender information, checks customer-domain and legitimate-sender hints, identifies Reply-To mismatches, and assembles the message, links, domains, IPs, attachments, and body into a traceable case.
- Tiered assessment: An AI pre-triage reviews the complete email without external lookups. Enrichment is skipped only when the message is judged legitimate with confidence above 0.9; other cases are checked against URL, domain, hash, and IP reputation using VirusTotal and AbuseIPDB, with the final response validated before routing.
- Decision routing: High-confidence phishing is sent to automatic remediation, while high-confidence legitimate reports are closed. All other outcomes are presented to an analyst in a Teams card with options to remediate, mark legitimate, or ignore; an approved remediation invokes the configured action to delete the email across the tenant and block the sender.
- Record and response: The workflow creates a Jira case containing the report, pre-triage, final verdict, evidence, indicators, and next step, then returns the verdict, outcome, ticket key, and reporter message. This demonstration uses synthetic evidence and locally replayed Jira responses rather than live service results.
What changed
Every report now follows a consistent guarded route from intake to disposition. Confidence checks automatically determine whether to close the report, enrich it, request a Teams decision, or invoke remediation, while the case record and reporter response are prepared as part of the same workflow.
Work removed
Manually assembling case details, checking whether enrichment is needed, coordinating reputation lookups, preparing Jira ticket content, composing the reporter response, and initiating the remediation handoff.
Expected outcome
Each report receives one standardized case, one evidence-based routing decision, one recorded disposition, and one prepared reporter response, with manual review retained for uncertain cases.
