Before
Analysts had to inspect each incoming email, determine whether it was a direct submission or a forwarded report, and extract the suspicious message from forwarded content. They also had to route the normalized report to assessment and acknowledge the employee manually when appropriate.
How it works
- Receive and normalize the email, preserving the relevant message content and metadata.
- Detect whether the report was forwarded and extract the original suspicious message when necessary.
- Send either structured route to the phishing assessment workflow, acknowledge forwarded reporters, and suppress replies to direct submissions.
Workflow details
- Report intake: The workflow starts when an email reaches the phishing reporting address and safely normalizes its subject, body, headers, message identifier, date, sender details, analysis data, and attachments.
- Message classification: It checks the subject and body for forwarding indicators, including forward prefixes, forwarded-message markers, and original From/Subject blocks. This separates a user-forwarded report from a suspicious email sent directly to the reporting address.
- Case preparation: For forwarded messages, it extracts the original suspicious email and preserves the employee reporter as the contact. For direct submissions, it retains the submitted message and deliberately avoids treating the sender as a reporter because the sender may be the attacker.
- Assessment handoff: Both routes pass a structured case to the same phishing assessment workflow for AI pre-triage, conditional enrichment, ticketing, remediation or analyst decision. Forwarded reports receive an acknowledgement in the configured demonstration, while direct submissions complete without a reply.
What changed
Every incoming report is converted into the same structured assessment handoff before human review. Forwarded and direct submissions are routed automatically, with the acknowledgement decision applied consistently and direct-email senders excluded from replies.
Work removed
Manually reviewing raw report emails, identifying forwarding indicators, extracting the original suspicious message, assembling report details for assessment, choosing the correct processing route, and sending acknowledgements for forwarded reports.
Expected outcome
Each report receives one consistent assessment handoff, with at least two recurring manual handling actions removed per report and an additional acknowledgement step removed for forwarded submissions.
