Before
An analyst would likely parse the suspicious email manually, copy sender addresses and URLs into separate reputation or scanning tools, and inspect attachment hashes individually. The findings would then need to be assembled into a readable report and sent to the relevant recipient.
How it works
- Parse the submitted email and extract sender addresses, URLs, and attachments.
- Automatically route each available artifact to the appropriate reputation or threat-intelligence check, while skipping branches for missing URLs or attachments.
- Format the collected findings into a consolidated report and email it to the configured recipient.
Workflow details
- Email parsing and extraction: The workflow receives an email for analysis, parses its contents, extracts sender email addresses, identifies URLs, and separates any attachments for further review.
- Sender reputation review: Extracted sender information is checked through EmailRep.io to provide reputation-related findings for the email originators.
- URL investigation: When URLs are present, the workflow extracts them, submits them for scanning through URLScan.io, checks whether the scan succeeds, and retrieves detailed results for successful scans.
- Attachment investigation: When attachments are present, the workflow extracts them, searches their file hashes in VirusTotal, and formats the returned findings for inclusion in the report.
- Report delivery: The workflow combines the available sender, URL, and attachment findings into a formatted table and sends the consolidated analysis to the configured email recipient.
What changed
The analysis now begins automatically from a submitted email and performs the available sender, URL, and attachment checks without requiring separate manual tool lookups. Results from the applicable branches are combined into one formatted email report, while no human approval step is shown in the workflow.
Work removed
Manually parsing the email, extracting sender addresses and URLs, separating attachments, submitting URLs for scanning, retrieving scan results, checking attachment hashes, formatting findings into a report, and sending the completed analysis by email.
Expected outcome
When an email contains senders, URLs, and attachments, the workflow can replace at least three separate evidence-gathering lookups with one consolidated report, reducing tool switching and manual report assembly.
