Use Case: Email
Automated phishing triage
Your analyst spends 25 minutes on each user-reported phishing email. ManySignal triages it in 90 seconds — URL analysis, sender authentication, click detection, and a verdict.
600 reports a month, 3 analysts, no automation
A mid-sized enterprise receives 400-800 user-reported phishing emails per month. The manual triage process involves: opening the email in a safe viewer, extracting URLs, submitting them to VirusTotal, checking the sending domain's DMARC record, searching M365 for other recipients, checking the user's account for post-click activity, and writing a disposition. This takes 20-35 minutes per email when done properly — which means it often isn't.
ManySignal's phishing triage agent runs all seven of those steps in parallel within 90 seconds. The analyst receives a completed triage package with a confidence-scored verdict. They approve or override. The entire queue of 600 monthly reports becomes 10-15 cases that genuinely need human judgment.
workflow: phishing_triage_automation
trigger:
- user_report: outlook_add_in, gmail_button
- OR email_gateway: dmarc_fail + high_risk_url
steps:
parallel:
- url_reputation: urlscan, virustotal, phishtank
- url_dereference: headless_browser_redirect_chain
- sender_auth: dmarc, dkim, spf lookup
- domain_similarity: levenshtein_distance(known_domains)
- recipient_scope: m365_message_trace
- post_click: idp_activity, proxy_click_through
- attachment_sandbox: behavioral_detonation
verdict:
- MALICIOUS if: url_hit OR click_detected OR domain_impersonation
- SUSPICIOUS if: dmarc_fail OR new_sender_domain
- BENIGN if: all_clean AND sender_known_goodHas any URL in the email been visited by the recipient since receiving it?
Proxy / browser historyDoes the sending domain have a valid DMARC, DKIM, and SPF record?
DNS lookupIs any URL in the email resolving to a known phishing kit or credential harvester?
URLScan / VT / PhishTankWas a similar email sent to other recipients in the organization?
M365 / GSuite message traceDid the user's account show any anomalous activity in the 2 hours after email receipt?
IdP + app auditIs the email impersonating a known vendor or internal executive?
Domain similarity analysisHas this sender or domain appeared in other phishing reports in the past 30 days?
Threat intelDid the email bypass filtering — and if so, which filter missed it and why?
Email gateway logQuarantine the email from all recipient mailboxes using soft-delete via M365 or GSuite API
AutonomousBlock the sender domain and all URLs at the email gateway and proxy layer
AutonomousNotify all recipients who received the email, with clear guidance on not clicking
AutonomousIf URL was clicked: treat affected accounts as potentially compromised, initiate triage
Approve-gatedSubmit email headers and URLs to PhishTank and internal threat intelligence
AutonomousMITRE ATT&CK mapping
Phishing triage FAQ
How does ManySignal handle the volume of user-reported phishing emails?
ManySignal triages every reported email autonomously within 90 seconds. The triage agent checks URL reputation, sender authentication, and recipient activity simultaneously. Only emails with indicators of active compromise — clicked URLs, anomalous post-receipt activity — escalate to human analysts.
Can ManySignal proactively retract phishing emails without a user report?
Yes, for campaigns detected via other signals — suspicious URL in network proxy logs, a threat intelligence feed match, or a DMARC failure pattern. ManySignal can initiate a proactive sweep of all mailboxes for emails from the same sender and quarantine them before users interact.
What happens if the phishing URL was behind a redirect that bypassed scanners?
Redirect chains are unwound at alert time using a headless browser that follows all hops to the final destination. This catches redirect-based evasion that defeats static URL scanners. The final destination is checked against reputation feeds and rendered for visual inspection by the analyst.
Does ManySignal analyze attachments?
Email attachments are detonated in an isolated sandbox environment. The behavioral output — processes spawned, network connections made, files written — is normalized and compared against known malware behavior patterns. Results are included in the triage package.
Triage 600 phishing reports a month with 3 analyst hours
90-second automated triage. Human review only for cases that need it.