Before
Analysts manually opened each report, inspected attachments and message indicators, searched for delivered copies, and assembled the evidence for assessment. They then handled remediation, analyst handoffs, filing, and reporter replies as separate activities.
How it works
- Parse the reported message and attachments, gather mailbox evidence, and build a structured case for assessment.
- Validate the verdict and confidence, automatically route high-confidence outcomes, or request a human decision for ambiguous cases.
- Remediate confirmed phishing, file the report, and send the corresponding reply or acknowledgement.
Workflow details
- Evidence collection: The flow starts with a reported email from the SOC mailbox, reads its attachments, parses the original message when available, and assembles sender, subject, URLs, domains, attachments, and delivered-copy evidence into a case file.
- Message assessment: An AI review evaluates the sender, reply-to information, URLs, message content, and available headers, returning a verdict of phishing, suspicious, or legitimate with confidence, indicators, a summary, and rationale.
- Decision guard: Fixed validation rules normalize unsupported verdicts, compare confidence with the 0.9 automatic threshold, identify domains that may require blocking, and select automatic remediation, legitimate handling, or analyst review.
- Response routing: High-confidence phishing cases invoke remediation to block the sender or domain, remove identified copies, block relevant domains, and create brand-specific tickets; legitimate cases are filed without remediation.
- Human handoff and closure: Ambiguous cases receive a decision card with Remediate, Legitimate, and Ignore options and wait up to four hours. The selected path files the report, sends the appropriate reporter response or acknowledgement, and returns the outcome and verdict.
What changed
Evidence assembly, verdict validation, routing, filing, and routine communications now occur within one workflow. Only uncertain cases require an analyst decision, while high-confidence phishing can proceed directly to remediation and legitimate or ignored reports follow their defined closure path.
Work removed
Rebuilding case details from forwarded messages and attachments, checking verdict confidence against the automatic threshold, identifying copies and block targets, preparing routine remediation inputs, moving processed reports, and drafting standard reporter replies.
Expected outcome
A conservative expectation is that roughly 4–6 recurring manual actions are removed per report, while ambiguous cases retain an explicit analyst approval step and every case receives a documented outcome.
