Before
Responders had to remove message copies, block the sender and domains, look up recipient affiliations, and prepare tickets in separate operational steps. Evidence and removal results then had to be assembled manually for each affected brand.
How it works
- Receive the confirmed campaign response, prepare the remediation plan, and remove each identified message copy.
- Apply sender and domain controls, then verify the returned remediation results.
- Resolve recipient brands, create a high-priority ticket for each brand, and return a consolidated campaign summary.
Workflow details
- Campaign intake: The workflow receives a confirmed remediation object containing the phishing sender, subject, block type, domains, affected message copies, reporter, verdict, and reference.
- Message remediation: It prepares the response, processes each identified copy, records whether removal was confirmed, and groups recipients for downstream handling.
- Protective controls: It applies a sender block based on the required email address or domain control and submits the related domains for blocking, while checking whether the domain-list change is confirmed.
- Brand routing: It looks up each recipient to resolve the affected brand, display name, and office, then groups recipients by brand and prepares a high-priority ticket with removal status, campaign evidence, and response actions.
- Documented handoff: It opens one ticket through the appropriate brand ITSM workflow and returns a summary showing the sender-block result, copies removed, domain-control status, and ticket references. The ticket also prompts follow-up to determine whether a recipient clicked before removal.
What changed
The workflow performs the removal and blocking actions from one confirmed remediation object, checks the returned statuses, and routes a prepared high-priority ticket to each affected brand. Humans receive a documented handoff with removal evidence and a prompt to check whether a recipient clicked before removal.
Work removed
Manually reviewing each message copy, submitting repeated removal actions, applying sender and domain blocks, looking up recipient brand details, grouping recipients, copying remediation evidence into tickets, and manually assembling the final campaign summary.
Expected outcome
One documented remediation handoff per affected brand, with up to 5 message-copy removals and recipient lookups and 3 brand ticket routes processed concurrently in the configured flow.
