# Workflow — Phishing Triage & Response Agent

## 1. 1. Intake the report

Pull the reported email with full headers and raw body; extract sender, URLs, and attachments for analysis.

## 2. 2. Check authentication & reputation

Evaluate SPF/DKIM/DMARC and look up URL/domain/sender reputation — the fastest legitimacy signals.

## 3. 3. Detonate safely

Detonate URLs and attachments in the sandbox to reveal credential-harvest pages or malware, never touching live infrastructure.

## 4. 4. Scope the campaign

Search the environment for similar messages to find every affected recipient, not just the reporter.

## 5. 5. Decide the verdict

Classify on the combined evidence; only positive benign evidence clears an email, and mixed/insufficient evidence is suspicious.

## 6. 6. Contain or escalate

Auto-contain scoped high-confidence phishing on non-critical mailboxes; propose mass/exec actions for approval; escalate BEC/spear-phish to the SOC.

## 7. 7. Reply & learn

Send a clear reply to the reporter, log the evidence and outcome, and feed analyst agreement back to tune verdicts.
