email-threat-investigate

What problem does it solve?

It helps triage suspicious emails by turning scattered user reports and security signals into a consistent, evidence-based investigation and action recommendation.

Core Features & Use Cases

• End-to-end email tracing: correlates message metadata and threat context from user-provided details.
• Mimecast-based verdict collection: pulls sender reputation, TTP URL click logs, and attachment sandbox results when Mimecast is connected.
• Threat scoring and actionable output: assigns a threat level using defined signals and produces a structured investigation report with recommended next steps.
• Release/block guidance for ambiguous cases: supports Cerberus council invocation for quarantine release decisions that require additional confirmation.
• Use cases: user reports phishing, Mimecast fires an alert, or quarantine release is requested and needs validation before action.

Quick Start

Run the investigation by asking: "Investigate this suspicious email: [forwarded content or sender/subject/Mimecast message ID]."