Automate phishing alert triage with KnowBe4 PhishER and Cisco Talos
Build a workflow triggered by a KnowBe4 PhishER alert. Download and parse the EML to extract sender, domains, URLs, and IPs. Check domain/IP reputation against Cisco Talos and combine the signals into a verdict. Send a real-time notification (Slack/email) with the findings and update the PhishER disposition. Handle malformed EMLs, missing indicators, and API errors gracefully. Output the extracted IOCs and the triage verdict.
What this prompt builds
Unpack PhishER EML alerts, extract IOCs, check Talos reputation, and notify the team in real time.
The problem
PhishER surfaces reported emails but still needs an analyst to crack open each EML, pull indicators, and judge reputation. That manual step slows response to active phishing.
Solution and impact
This workflow unpacks PhishER EML files, extracts domains and IPs, cross-references reputation with Cisco Talos, and notifies the team in real time. Phishing alerts are triaged automatically with the context needed to act fast.