Phishing triage: an AI workflow for reported emails
Someone in Finance reports a “password expires today” email from a Microsoft lookalike domain. SPF and DMARC fail, the Reply-To is a Gmail address and two colleagues got the same message. The analyst needs a verdict, the blast radius and a containment plan, and the next ten reports in the queue are probably newsletters.
This workflow gives every report a cheap first pass. A small model pulls the indicators, a lookup checks them against your playbook and intel notes, and a router splits real phish from safe mail. Phish goes to a mailbox search and a stronger model that drafts containment, then waits for an analyst. Newsletters and awareness tests get a short reply to the reporter.
Free in Sim. No account or API key.
Sample input
Reported phish from Finance: "Password expires today" from Microsoft 365 <no-reply@micros0ft-support.com>. Login link on that domain, Reply-To is a Gmail address, SPF and DMARC fail. Three people in Finance got it. Real phish or safe?
How the workflow runs, step by step
1. Start
Reported email
The user's report starts the run, with the email headers attached.
Next: Pull indicators
2. Agent
Pull indicators
A small model pulls the sender, Reply-To, SPF/DKIM/DMARC results and links, defanged. It never visits a link.
Next: Intel lookup
3. Tool
Intel lookup
Searches your phishing playbook and intel notes, standing in for a threat intel platform.
Next: Verdict
4. Router
Verdict
Keyword rules pick the branch. Newsletters and awareness tests go to a reply; password, login, invoice or bank-detail lures go to the phish path, which is also the default.
Next: Mailbox search (phish), Reporter reply (safe)
5. Tool
Mailbox search
Searches the message trace for who else received the email, who clicked and any sign-in that followed.
Next: Containment plan
6. Agent
Containment plan
A stronger model drafts the verdict, blast radius and containment: purge, block and, if a password was entered, reset and revoke sessions.
Next: Analyst approve
7. Human approval
Analyst approve
The run pauses. An analyst approves the plan before anything is purged, blocked or reset.
Next: Incident ticket
8. Result
Incident ticket
The approved plan, ready for your ticketing system or Slack.
9. Agent
Reporter reply
For safe mail, a cheap model writes a short thank-you to the reporter that says what it was.
Next: Report closed
10. Result
Report closed
The reply closes the report. No analyst time, no strong model.
Why build it as a graph
Most reported emails are not phishing, so sending each one through a strong model wastes money and analyst attention. As a graph, the cheap steps read every report, the strong model only writes containment for real phish, and the analyst gate sits in the workflow itself rather than in someone's habits.
Things to try
- Run the sample in Sim. It takes the phish path and pauses for your approval.
- Report “weekly vendor newsletter, SPF and DKIM pass, unsubscribe link” instead and run again. It closes with a cheap reply.
- Apply a cheaper-model insight in Improve, then choose “Test 3 cases before and after”. Three reported emails run on both graphs, and the card shows whether all three still pass.