Before
A security analyst likely had to open and parse each suspicious email, extract sender addresses, links, and attachments, and review each indicator separately. They then had to switch between reputation and threat-analysis tools, assemble the findings, and send a summary to the requester.
How it works
- Receive and parse the incoming email, extracting sender addresses, URLs, and attachment information.
- Check the extracted indicators conditionally: query sender reputation, scan available URLs, and look up attachment hashes when present.
- Format the combined findings into a report and email it to the requester.
Workflow details
- Email intake and parsing: An incoming email triggers the workflow, which parses the message content and extracts email addresses, URLs, and attachment information for investigation.
- Sender analysis: Extracted sender addresses are checked through EmailRep to gather reputation information, and the results are formatted for inclusion in the final analysis.
- URL investigation: The workflow determines whether URLs are present. When they are, it submits them for URLScan analysis, retrieves detailed scan results after a successful submission, and adds those findings to the report.
- Attachment investigation and delivery: When attachments are present, their file hashes are checked in VirusTotal. The workflow combines sender, URL, and attachment findings into a formatted table and emails the completed phishing analysis to the requester.
What changed
The analysis now starts automatically when an email is received, with indicator extraction, conditional reputation and threat checks, result formatting, and email delivery handled in one workflow. The requester receives a consolidated report without requiring an analyst to perform each lookup and handoff manually.
Work removed
Opening and parsing suspicious emails, extracting sender addresses, URLs, and attachments, performing separate EmailRep, URLScan, and VirusTotal lookups, checking whether URLs or attachments are present, assembling the findings into a table, and manually emailing the completed analysis.
Expected outcome
One consolidated phishing analysis is produced per submitted email, removing several recurring extraction, lookup, formatting, and notification actions from the manual review process.
