End-to-end suspicious email triage and IOC blocking
Build a workflow triggered by a submitted suspicious email. Extract and analyze attachments (VirusTotal), URLs (URLScan.io), the sender (EmailRep), and headers. Score the email; if malicious, add the relevant IOCs to CrowdStrike's blocklist and NextDNS denylist, and open/update a Jira case with the evidence. Deduplicate IOCs already blocked, handle partial enrichment failures, and require approval before blocking broadly. Output the verdict, the IOCs blocked, and the Jira ticket reference.
What this prompt builds
Investigate reported emails across files, URLs, and headers, then push the malicious IOCs to blocklists.
The problem
Even after an analyst confirms an email is malicious, the indicators rarely get pushed to every blocking control, so the same campaign keeps landing. Manual blocklist updates across tools are slow and inconsistent.
Solution and impact
This workflow performs full triage of files, URLs, and headers, then adds confirmed IOCs to CrowdStrike and NextDNS blocklists while logging the case in Jira. Confirmed threats are contained organization-wide in one pass instead of trickling out as manual edits.