Automatic triage of suspicious emails for threats

Takes incoming emails, opens an incident case, extracts the sender, domains and IPs and checks their reputation through threat analyzers — filing the results into the case.

• Every email becomes a ready incident case
• Auto-checks sender, domains and IPs against threat databases
• Results collected in a single case
• The analyst works from ready data, not from scratch

Email Trigger (IMAP)TheHiveCortex