This workflow automates phishing email analysis by extracting URLs from incoming Outlook messages, scanning them with URLScan.io and VirusTotal, and sending detailed security reports to Slack. It helps security teams quickly identify malicious links, streamline incident response, and strengthen phishing defenses. The workflow can run manually or on a schedule for continuous monitoring.
Features:
- 📧 Email Integration – Fetches unread messages from Microsoft Outlook (can be replaced with other providers).
- 🔎 IOC Detection – Extracts indicators of compromise (IoCs) like URLs using Python and the
ioc-finderlibrary. - 🌐 URL Analysis – Submits URLs to URLScan.io for detailed scanning and reporting.
- 🛡 Threat Intelligence – Uses VirusTotal to evaluate phishing risks, checking against multiple threat databases.
- 🔄 Automated Processing – Runs on-demand or via schedule to ensure continuous monitoring.
- ✅ Inbox Management – Marks processed emails as read to prevent duplication.
- 📊 Consolidated Reporting – Merges VirusTotal and URLScan results for a unified threat assessment.
- 💬 Slack Notifications – Sends structured phishing analysis reports (subject, sender, date, verdicts) directly to Slack for quick action.
