Automated phishing email triage: senders, URLs, and attachments
Build a workflow triggered by a reported phishing email (mailbox, webhook, or form). Parse the message to extract sender, URLs, and attachment hashes. In parallel branches, check the sender reputation in EmailRep, scan URLs in URLScan.io and VirusTotal, and evaluate the message in Sublime Security. Merge the results into a single risk verdict with supporting evidence, handle missing indicators and API rate limits, and retry transient failures. Output a consolidated report classifying the email and recommending an action.
What this prompt builds
Enrich a reported phishing email's sender, links, and attachments across multiple intel services in parallel.
The problem
Analysts burn time manually copying sender addresses, URLs, and file hashes from suspicious emails into separate threat-intel tools. The slow, repetitive triage delays response and lets phishing campaigns spread.
Solution and impact
This workflow forks the analysis of a reported email, enriching the sender via EmailRep, URLs via URLScan.io and VirusTotal, and content via Sublime Security simultaneously. Triage that took 15+ minutes per email becomes a consistent, automated verdict in seconds.