Suspicious email triage with case management and IOC blocking
Build a workflow triggered by a submitted suspicious email that opens a case. Analyze attachments (VirusTotal), URLs (URLScan.io), and the sender (EmailRep), recording findings in the case. On a malicious verdict, add IOCs to CrowdStrike and other blocklists with approval, and update the case status. Deduplicate IOCs, handle partial failures, and retry. Output the case with evidence and the IOCs blocked.
What this prompt builds
Triage reported emails across files, URLs, and headers in a managed case, then block confirmed IOCs.
The problem
Phishing triage often lacks a system of record, so investigations aren't tracked and confirmed indicators don't get blocked everywhere. Repeat campaigns succeed and there's no audit trail.
Solution and impact
This workflow analyzes files, URLs, and headers, documents everything in a case, and pushes confirmed IOCs to blocklists like CrowdStrike. Each report becomes a tracked case and confirmed threats are contained across controls.