Phishing response
A reported email goes from the user's inbox to a verdict, a mailbox-wide cleanup and an answer to the reporter. An analyst steps in only when the analysis is unsure.
The problem
Phishing reports arrive all day. Each one needs header analysis, link and attachment checks, a search for other recipients, a purge and a reply to the person who reported it. Done by hand, the email stays in other mailboxes for hours.
Stack
- Microsoft 365Google Workspace
- Analysis
- The Phish AnalyzerVirusTotalurlscanRecorded Future
- Cases and responders
- TheHiveCortexCortex XSOAR
- Identity and endpoint
- Entra IDMicrosoft DefenderCrowdStrike
How it works
- 1
Collect
The report button or the abuse mailbox forwards the message as an attachment. The playbook extracts headers, sender, URLs, attachments and the reporter.
- 2
Analyze
SPF, DKIM and DMARC results are checked, URLs are scanned and opened in an isolated browser, files are detonated in a sandbox, and indicators go through threat intelligence. The Phish Analyzer, the tool I built, covers the same workflow for manual cases.
- 3
Judge
An LLM reads the message and the technical results and writes a verdict with reasons. Clear cases are decided by rules. Borderline cases go to an analyst.
- 4
Contain
For a malicious email, the playbook searches every mailbox in Microsoft 365 or Google Workspace for the same message and purges it. It blocks the sender, the domain and the URLs at the mail gateway, the proxy and the EDR.
- 5
Check exposure
It looks for users who clicked or opened the file. For those users it triggers a password reset and a session revocation in Entra ID, with approval where policy requires one.
- 6
Close
The reporter receives a clear answer, and the case records the indicators, the actions and the timing.
Guardrails and failure handling
- Purges match on message identifiers and are limited to the scope the policy defines. A new deployment starts in dry-run mode and lists the affected recipients before it deletes anything.
- Internal senders and phishing-simulation platforms sit on an allow-list, so a training email is never purged.
- Reply templates to reporters are reviewed by the security team.
- Every action is logged in the case with its timestamp and its input.
What changes for the SOC
- A malicious email is removed from every mailbox by the playbook, not by an analyst searching one mailbox at a time.
- Reporters get an answer, which keeps them reporting.
- Analysts see only the borderline cases.