AI-Analyzed User-Reported Phishing Email to XDR Detection

Prerequisites

Before installing this workflow, ensure the following targets are available:

• Email Target

  • Microsoft O365 email target is supported
  • Used to monitor a dedicated mailbox for user-reported emails

• OpenAI Target

  • OpenAI or Azure OpenAI target
  • Used to generate analyst-ready detection descriptions

• Optional Notification Targets

  • Email address for SOC notifications
  • Webex space (optional)

Installation Steps

1. Add an Email Target

   • Configure an O365 Email Target with access to a dedicated mailbox.
   • This mailbox will be used for phishing submissions.

2. Install the Workflow

   • During installation, select Automate it when prompted.
   • Create an email automation rule that monitors the mailbox for new messages, using the earlier created Target.

3. Configure Automation Rule

   • This triggers the workflow when a new email arrives in the monitored mailbox, using the earlier created Target.
   • No additional filtering is required.

4. Add an OpenAI Target

   • Configure an OpenAI or Azure OpenAI target. Currently it is set to use GPT-4o. Make sure this model is available for this target.
   • Ensure the target is accessible to this workflow for AI-based analysis.

5. Set Input Variables

   • SOC Notification Email: Email address to receive detection notifications.
   • Webex Space ID (optional): Space to receive notifications.

Usage

• End users report suspicious emails by forwarding them as an attachment to the monitored mailbox.
• The workflow automatically analyzes the email and creates an XDR detection.
• If an email is forwarded incorrectly, the workflow replies with instructions to resend it as an attachment.
• SOC analysts review the generated detection and take appropriate action.

Notes

• This workflow assumes detections are created only when suspicious or malicious observables are present.
• Webex notifications are optional; email notifications are recommended for initial deployments.
• ⚠️ This Workflow uses AI, properly test before using in production!