Before
Security staff likely had to inspect email headers, authentication results, relay IP addresses, and message content manually across multiple analysis tools. They also had to notify the security team, search users' mailboxes for matching messages, and remove copies one mailbox at a time.
How it works
- Receive the email, parse its authentication and relay details, and check for DKIM or SPF failures.
- Investigate each received IP and analyze the message body for phishing language, urgency, link encouragement, and spam indicators.
- When the configured conditions identify phishing or malicious activity, notify the security team and search and delete matching messages across user inboxes.
Workflow details
- Email intake and header parsing: The workflow receives an email through an email hook and extracts key details from its headers, including the Message-ID, DMARC, DKIM, SPF, received-server list, and associated IP addresses. These details help identify failed authentication checks and possible sender spoofing.
- Authentication and IP investigation: If DKIM or SPF checks fail, the workflow can escalate the message directly to the security team. Otherwise, it evaluates each IP address in the received list using an IP reputation report and then checks whether the resulting information indicates malicious activity.
- AI content analysis: Messages that continue through the investigation are forwarded for language-model analysis of the email body. The analysis considers language, urgency, encouragement to click links, specific phishing patterns, and the likelihood that the message is spam or phishing.
- Automated response decision: The workflow combines the header, IP, and content-analysis results to determine whether the email is marked as phishing or otherwise meets the configured suspicious-message conditions. No human approval step is shown before the response actions occur.
- Security notification and mailbox cleanup: For a flagged message, the workflow sends an email to the configured security team, lists users, searches each mailbox for the message by subject, and deletes the matching message when it is found.
What changed
Email analysis now starts automatically when a message arrives, with header checks, IP lookups, and content analysis performed in sequence. A suspicious result triggers the security notification and mailbox-remediation process without requiring a person to move between investigation tools or perform user-by-user searches first.
Work removed
Manually reviewing email headers and authentication failures, checking each relay IP, assessing message content for phishing patterns, notifying the security team, listing affected users, searching mailboxes by subject, and deleting matching messages.
Expected outcome
For each flagged message, the workflow conservatively removes at least one manual security notification and one manual mailbox-remediation pass, with additional searches and deletions avoided for every affected user.
