System for Preparing Suspicious Email Reports for Analyst Review

The problem

In day-to-day operations, user reports, email headers and security signals arrive through different systems and event records, preventing the team from seeing the case on a single timeline.

As a result, source links can be lost while the reasoned review summary is prepared, the case can be routed to the wrong team, and the basis for the technical decision can remain unclear.

An incomplete workflow may overlook a case where phishing cannot be distinguished from legitimate business correspondence, while an incorrect system action could block a legitimate email or miss the threat.

What we set out to improve

• Time taken for the draft reasoned review summary to be ready for specialist review
• Correct referral of records where phishing cannot be distinguished from legitimate business correspondence to the appropriate specialist queue
• Record of recommendations corrected or rejected by the SOC analyst

How the system works

1. 01 Retrieve user reports, email headers and security signals from authorised sources
2. 02 Verify the source, timestamp and record identifier
3. 03 Add the relevant asset, user, shop, vehicle or content context
4. 04 Prepare a draft reasoned review summary
5. 05 Compare the draft with technical rules and authority boundaries
6. 06 Check for exceptions: phishing cannot be distinguished from legitimate business correspondence
7. 07 Obtain the SOC analyst's approval, correction or rejection
8. 08 Write the input, recommendation, changes and final decision to the audit log

Methods we used

• Source- and time-traceable data extraction for user reports, email headers and security signals
• Structured output that restricts the reasoned review summary fields to technical rules
• An exception gate that separates cases where phishing cannot be distinguished from legitimate business correspondence from system action
• An authorised queue that presents the evidence and recommendation together for the SOC analyst
• Duplicate-processing controls and a rollback record to address the risk of blocking a legitimate email or missing the threat

Where people stay involved

Data and security

Only fields required for the task are processed from user reports, email headers and security signals. Source-system permissions are preserved, and unnecessary personal, technical and security-sensitive data is minimised before being sent to the model. Every retrieval, recommendation, human change and target-system action is written to the audit log.

Who this suits

Frequently asked questions