Phishing report triage

Turns an employee phishing report into a verified verdict and a block decision the same day.

macOS — coming soonSee the 4 automations
IT / AUTOMATE.md

When a phishing report lands, pull the original message and headers, check whether the gateway delivered it, and post a verdict of phish, credential harvest or benign with the evidence.

## Verdicts
SignalVerdict
Link to a login pageCredential harvest
Known sender, odd reply-toSuspicious
Internal newsletterBenign
-Never block or purge — post the verdict for an analyst.
Ready-made: Phishing Report Verdict

The job, and what good looks like.

Reports arrive as forwarded messages with no context, so the analyst has to re-derive the sender, the real link target, and whether anyone else received the same file. Six people report one phish and it gets worked six times. The workflow starts at the report. It pulls the original message and its headers from the report mailbox, checks whether the mail gateway delivered or already blocked it, and looks for the same indicators in the previous 30 days. It sets one verdict from a fixed set: confirmed phishing, credential harvest, benign, or cannot tell. The evidence behind that verdict is attached to the case rather than described in it. From there the boring parts happen the same way every time. One case is opened for the incident, the impacted recipients are listed, the indicators go to the block list, and a human approves the company-wide block and any message to staff. A report that turns out to be a real account takeover moves to incident triage instead of closing. A human still approves every block, every purge, and every outbound notification.

When it is handled

  • Verdict within 30 minutes of the report
  • One case per incident, not per reporter
  • Confirmed phishing blocked company-wide

Works with tools like

  • Microsoft Defender for Office 365
  • Proofpoint
  • Microsoft Sentinel
  • Jira Service Management

Ready-made automations. Pick the one that fits.

Each one is a plain-language document. Run it as it is, or change the timing, the rules and the tools to match your team.

Account Takeover Hunt

When a flagged inbox session shows an account takeover, list the mailbox rules added in the last week, summarise sign-ins from new locations, and post the findings before anyone resets the account.

When an account takeover session is flagged

Phish Campaign Hunt

Once the mail log confirms a phish, search for other delivered copies by sender and link target, then open a ticket with the purge list and every account that clicked.

When a reported message is confirmed as phishing

Phishing Report Verdict

When a phishing report lands, pull the original message and headers, check whether the gateway delivered it, and post a verdict of phish, credential harvest or benign with the evidence.

When an employee reports a suspicious email

Proofpoint Phishing Triage

When a submitted message matches a known campaign, open one ticket listing every recipient, then ask an analyst to approve the campaign-wide block.

When a submitted message matches a known threat campaign

You stay in charge.
At every step.

It triages and sweeps. People approve every change.

  • No change without approval

    Blocking, revoking and purging wait for an analyst's OK.

  • Every run on the record

    What it read, what it did and what it is waiting on, kept for review and audit.

  • Scoped per automation

    Each automation gets only the access you grant it, and a local model can keep processing on your machine.

Phishing Report Verdict

Approve before it posts in Slack?

ReviewApprove

Before you download.

Where does it run?
On your Mac or Windows computer, in the background. It keeps working after you close its window, and only reaches the folders and apps you connect for each automation.
How does it connect to our CRM and other tools?
Through each app's own connection where it offers one, signed in once by you, or by using the app in a browser the way you would. Each automation gets only the connections you give it, and the tools a page names are examples you can swap for your own.
Does it run when my computer is asleep?
It keeps your computer awake while a job runs and just before a scheduled one. While the computer is closed or off, nothing runs; when it wakes, it checks the inbox, calendar and other sources it watches for anything that arrived meanwhile.
How does my team use it?
Each person who runs automations installs the app. Keep a project in a shared folder, such as Google Drive or a network drive, and teammates can open it and follow every run, while one person owns it and runs it.
Do I need anyone technical to set it up?
No. Download the app, add an automation in plain words, and connect only what that job needs. Nothing runs until you switch it on.

Already have tools for this? Here is the difference.

Scripts and scheduled jobs

Precise, repeatable system tasks.

They break on the unexpected, and only their author can read or change them.

Security automation platforms

High-volume response playbooks in large teams.

They need a project to set up and an engineer to maintain each playbook.

AI chat assistants

Explaining an alert when you paste it in.

Nothing runs on schedule, and there is no scoped access or record of what was done.

AUTOMATE.md

Your routine, written in plain words. It runs on its own, follows your rules, handles the exceptions a flowchart can't, and asks you when it matters. The file stays yours, whichever AI model runs it.

Related workflows.

Incident triage

Turns an incoming alert into one case with an owner, a severity and a first decision, so response starts while the detail is still arriving.

Write your own

Log analysis

Converts a vague question about whether something happened into a scoped search with a written answer, its sources, and its limits.

Write your own

Audit trails

Joins the scattered administrative change records into one timeline, so an auditor's question is a search rather than a fortnight of exports.

Write your own

Start with one job.
Make it your own.

macOS — coming soon
  1. 1

    Get the app

    It runs on your computer, next to your files.

  2. 2

    Add the automation

    Paste the instructions into the app, or save them as a file next to your work.

  3. 3

    Try it, then turn it on

    Run it once and check the result. It only runs on its own once you switch it on.

macOS — coming soon