Before
An employee or security team member likely had to extract the attachment, submit it for malware analysis, interpret the result, and then search the mailbox for the related message. For a malicious file, they also had to delete the message and notify the affected recipient separately.
How it works
- Receive a forwarded email and submit its first attachment for malware analysis.
- Check the analysis result and stop successfully when the attachment is not identified as malware.
- For a malicious result, locate and delete the related mailbox message, then notify the recipient in Slack.
Workflow details
- Trigger and attachment intake: An employee forwards an email with an attachment to the dedicated email hook. The workflow takes the first attachment from the forwarded message and submits it for malware analysis.
- Automated verdict: The workflow retrieves the analysis result and checks whether the attachment is identified as malware. Clean or non-malicious files follow a successful completion path without remediation.
- Mailbox remediation: When the attachment is flagged as malicious, the workflow searches the mailbox for the related message using the sender and recipient information, retrieves the matching message, and deletes it.
- User notification: After deletion, the workflow finds the corresponding Slack user and sends a warning stating that a suspicious file was detected, identified as malware, and removed from the mailbox.
What changed
Attachment analysis, the malware decision, mailbox lookup, deletion, Slack user lookup, and notification now occur as one automated handoff after the employee forwards the email. Human involvement is no longer required for the routine screening and malicious-message cleanup path.
Work removed
Manually extracting and submitting the attachment for analysis, reviewing the malware verdict, searching the mailbox for the related message, retrieving and deleting it, looking up the recipient in Slack, and composing the warning notification.
Expected outcome
For malicious attachments, the workflow removes at least three recurring manual actions per incident—mailbox search, message deletion, and recipient notification—while providing a consistent analysis and remediation path.
