Before
The security team polled the reporting mailbox and opened reports individually. They then handed each report to the assessment process and compiled the number of handled reports and their outcomes manually.
How it works
- Read the reporting mailbox and identify messages that were not sent by the mailbox itself.
- Hand each remaining report to the phishing assessment workflow, processing up to two reports concurrently.
- Collect the assessment results and return the processed count with a per-report summary.
Workflow details
- Trigger and intake: An on-demand asynchronous webhook starts the workflow, which reads the configured reporting mailbox and obtains the available messages.
- Message filtering: The workflow removes messages sent from the reporting mailbox itself, helping prevent replies or self-generated messages from re-entering the assessment queue.
- Assessment handoff: Each remaining report is passed to the phishing assessment workflow, with up to two reports handled concurrently.
- Batch summarization: The results are collected into a batch summary containing each report's subject, verdict, and outcome, or a no-new-report message when the queue is empty.
- Operational result: The flow returns both the processed-report count and the summary, keeping mailbox collection separate from the assessment verdict while creating a repeatable intake queue.
What changed
Mailbox collection, self-sent-message filtering, assessment handoff, and result summarization now occur automatically from one trigger. The assessment workflow supplies the verdict and outcome, while the intake flow presents the processed count and consolidated summary for review.
Work removed
Manual mailbox polling, opening and selecting reports one by one, excluding self-sent messages, handing reports to the assessment workflow, and compiling the batch count and per-report outcome summary.
Expected outcome
A repeatable reported-email intake queue that can assess up to two reports concurrently per run and consistently produce a consolidated processing summary.
