Parse forwarded phishing emails and nested EML attachments
Build a workflow triggered by emails arriving in a phishing reporting inbox. Parse the message, extract attachments, and recursively unpack any .eml attachments to reach the originally reported email. Pull sender, subject, URLs, and attachment hashes, optionally checking sender reputation with EmailRep. Handle deeply nested or malformed EMLs and unsupported attachment types gracefully. Output the normalized original email and its extracted indicators.
What this prompt builds
Read forwarded phishing reports including attachments and nested .eml files for analysis.
The problem
When users forward phishing as .eml attachments, the real message is wrapped one or more layers deep, and parsing that by hand is fiddly and inconsistent. Triage stalls before analysis even begins.
Solution and impact
This workflow reads a forwarded report, extracts the email, its attachments, and any nested .eml files, surfacing the true original message and indicators. Reported phishing becomes machine-readable input for downstream enrichment.