# Phishing Triage & Response Agent

> A phishing-triage agent that enriches reported emails, sandbox-detonates indicators, scopes campaigns, and quarantines, blocks, or escalates BEC — approval-gated.

- **Category:** Security & SecOps
- **Difficulty:** Advanced
- **Setup time:** 50 min
- **Stacks:** Claude, LangGraph, OpenAI
- **Version:** 2.0.0 (updated 2026-06-21)
- **Source:** https://agent-kits.com/kit/phishing-report-analyzer

## Overview

Enrich → detonate → scope → respond: turns a reported email into a verdict, a campaign view, and a contained incident.

Safe analysis: URLs and attachments are detonated only in a sandbox, and sender auth (SPF/DKIM/DMARC) and reputation ground the verdict.

Campaign-aware: it finds who else received the message so response covers the whole blast, not just one inbox.

Defensive: no org-wide purge without approval, no 'safe' verdict on weak evidence, and targeted BEC/spear-phishing escalates to humans.

## When to use it

- Your security team triages a high volume of user-reported suspicious emails and most of the work is enrichment and obvious-case handling.
- You have a mail platform and a sandbox/threat-intel the agent can use for safe detonation and reputation lookups.
- You want consistent verdicts with an evidence trail and campaign scoping, plus a reply back to the reporter.
- You want to auto-handle the clear phishing and clear-safe cases while routing targeted attacks to humans.

## When not to use it

- You have no sandbox or threat-intel for safe analysis — verdicts would be guesses.
- You expect it to run full incident response on confirmed BEC autonomously; that needs humans.
- You can't give it scoped mail-platform access for quarantine actions.
- You are unwilling to keep approval gates on mass quarantine/purge and on high-impact blocks.

## Architecture

- **Report intake** — Ingests the user-reported email (with full headers and raw body) from the mail platform or abuse mailbox and normalizes sender, subject, URLs, and attachments.
- **Authentication & reputation** — Checks SPF/DKIM/DMARC alignment and looks up domain/URL/sender reputation against threat intel — the first, cheapest signals of legitimacy.
- **Sandbox detonation** — Detonates URLs and attachments in an isolated sandbox to observe redirects, credential-harvest pages, and malware behavior, never touching live infrastructure.
- **Campaign scoping** — Searches the mail environment for similar messages to determine how many recipients are affected, turning one report into the full blast radius.
- **Verdict & response gate** — The model classifies on the combined evidence; a deterministic gate enforces sandbox-only analysis and routes mass/exec-impacting actions to human approval.
- **Containment & comms** — Quarantines the scoped campaign, blocks indicators, and replies to the reporter; high-impact actions are staged for approval.
- **Escalation & learning** — Routes BEC/spear-phish to the SOC with evidence, and logs analyst agreement to tune verdicts and reduce false clears/alarms.

## Files in this bundle

- `system-prompt.md` — the agent's system prompt
- `tools.json` — tool/function definitions the agent expects
- `workflow.md` — step-by-step run loop
- `.env.example` — environment variables to fill in
- `kit.json` — full structured metadata
- `starters/` — minimal starter snippets
- `LICENSE` — Apache-2.0 (code, configuration, and schema)
- `LICENSE-CONTENT` — CC BY 4.0 (specification text and documentation)
- `NOTICE` — attribution and trademark notice
- `run.py` — **runnable demo**: real agent loop with mock tools (`pip install anthropic`, set `ANTHROPIC_API_KEY`, `python run.py`)
- `agentaz.json` / `agentaz.schema.json` — AgentAz™ governance spec + schema

## Implementation notes

- Keep all detonation sandbox-only and enforce it outside the model; the agent must never interact with live malicious infrastructure.
- Require positive benign evidence to clear an email. Mixed or insufficient evidence is 'suspicious' and escalates — false clears are the most damaging error.
- Scope the campaign before responding so containment covers every affected recipient, not just the reporter; gate org-wide and exec-mailbox actions behind approval.
- Treat BEC/spear-phishing as escalate-by-default: these have few classic indicators but the highest impact, and the right move is a human plus a warning about the requested action.
- Always reply to the reporter — clearly, and encouragingly even when it's a false alarm. Reporting culture is a security asset worth protecting.
- Backtest on resolved reports and track missed-true-positive rate as the primary safety metric before enabling any auto-containment.
- Reserve the strong model for the verdict and BEC judgment; a cheaper model can parse headers and run reputation lookups.

## Variations

- **Basic — Triage & enrichment assistant:** Enriches the reported email, detonates indicators in the sandbox, returns a verdict with evidence and a suggested response for an analyst. No autonomous containment.
- **Advanced — Guarded auto-containment:** Auto-quarantines scoped, high-confidence campaigns on non-critical mailboxes and blocks indicators, with campaign scoping, reporter replies, and approval-gated mass/exec actions.
- **Enterprise — Governed phishing response:** Adds multi-tenant mail integration, critical-mailbox policies, SOC/IR routing, full evidence audit, BEC analytics, and verdict calibration from analyst feedback at scale.

## FAQ

**Will it delete emails from people's inboxes automatically?**

Only a scoped, high-confidence campaign on non-critical mailboxes. Org-wide purges and anything touching executive or finance mailboxes are proposed for human approval, never executed autonomously.

**Is it safe to let it analyze malicious links and attachments?**

Yes — all detonation happens in an isolated sandbox. It never clicks, fetches, or opens suspect URLs/attachments in your live environment, and it doesn't echo live payloads.

**How does it avoid clearing a real phishing email?**

It only marks an email 'safe' with positive evidence — authentication passing and aligned, a known-good established sender, and clean sandbox/reputation results. Mixed or insufficient evidence is treated as suspicious and escalated.

**What about CEO-impersonation / wire-fraud emails with no links?**

Those (business email compromise) are escalated to your SOC by default, even with few classic indicators, and the agent tells the reporter not to action the request and to verify it out-of-band. The risk is the financial action, not malware.

**Does it handle a phishing campaign, not just one email?**

Yes. It searches your mail environment for similar messages to scope every affected recipient, so containment and blocking cover the whole campaign rather than the single reported copy.

**How do we adopt it safely?**

Start in advise mode where it only recommends, backtest on resolved reports to confirm it isn't missing true positives, then enable auto-containment for scoped, non-critical cases.


---

© 2026 AgentKits · www.agent-kits.com

**Open source.** Code, configuration, and the AgentAz™ schema are licensed under
**Apache-2.0**; specification text and documentation under **CC BY 4.0** (with
attribution to AgentKits, link to https://www.agent-kits.com). See LICENSE, LICENSE-CONTENT,
and NOTICE in this bundle. "AgentAz" and "AgentKits" are trademarks of AgentKits.

**Flagship reference blueprint.** View the source, AgentAz™ spec, and frozen v1.0 schema
in the public registry: https://github.com/agent-kits/agentaz
Original: https://agent-kits.com/kit/phishing-report-analyzer
