Before
Analysts had to unpack each reported message, identify the original email, inspect senders and links, compare them with trusted values, and decide how to route the case. They also had to explain the result to the reporter, notify the SOC when evidence was uncertain, and complete the resulting remediation or filing actions.
How it works
- Receive the reported message, recover the original email evidence, and build a normalized case file.
- Assess indicators and reputation observations, validate the result, and apply the 0.9 confidence rule to choose automatic closure, remediation, or analyst review.
- Reply to the reporter, file the processed report, and execute approved remediation or record the analyst's decision.
Workflow details
- Report intake: The flow starts when a message arrives from the support mailbox, extracts its identifying details, and retrieves the forwarded report or attached email. In the demonstration, attachment reading and parsing use locally replayed responses.
- Case preparation: It reconstructs the original sender, domain, subject, URLs, message content, and available headers, then checks the sender and domain against configured legitimate and whitelisted values.
- Security assessment: An AI analyst evaluates the sender, reply-to address, URLs, message content, headers, reputation observations, and consistency of the evidence. It returns a verdict of phishing, suspicious, or legitimate with confidence, rationale, and a reporter-facing explanation.
- Automated routing: A confidence above 0.9 sends phishing cases to automatic remediation and closes high-confidence legitimate cases. Lower-confidence or suspicious results are presented to the SOC in Teams for an analyst decision.
- Case completion: The flow replies to the reporter in plain language and files the processed report. An analyst can approve remediation, mark the message legitimate, or ignore the case; approved remediation performs the documented deletion and sender-blocking action.
What changed
Every report now receives a standardized assessment and response. High-confidence phishing and legitimate results are routed automatically, while uncertain cases are delivered to the SOC with the evidence, verdict, rationale, and explicit remediation, legitimate, or ignore choices.
Work removed
Unpacking forwarded reports and attachments, rebuilding email evidence, checking sender and domain allowlists, reviewing indicators and confidence thresholds, composing reporter replies, routing uncertain cases to the SOC, and filing processed messages.
Expected outcome
At least one documented response is produced for each reported message, with analyst involvement reserved for cases that do not meet the 0.9 confidence rule.
