Phishing reports are one of the most time-consuming parts of my day, and most of the steps are repetitive. I know this is a common use case for Tines but I’m not sure where to start. What does a solid phishing triage workflow look like, and what are the key building blocks I should be putting together?
Phishing triage is one of the most popular Tines use cases, if not the most popular, so there’s lots to draw upon on the site from a resources perspective.
A typical workflow starts with an email trigger, either a dedicated Tines mailbox that analysts forward suspicious emails to, or an integration with a reporting tool like KnowBe4 or Cofense. Tines parses the email using the built-in EML_PARSE or MSG_PARSE formula to extract the subject, sender, body, URLs, and attachments.
From there, you run enrichment in parallel: checking URLs against VirusTotal or URLScan, looking up the sender domain, and optionally detonating attachments in a sandbox. Based on the results, the story applies logic to classify the email and either auto-close it as benign, escalate it for analyst review via a Slack message or Page, or trigger a response action like blocking a domain.
The Tines Story Library has lots of ready-to-use phishing triage templates, so I strongly recommend checking some of those out for inspiration. The Blog has also has full walkthroughs of phishing workflows worth reading before you start building. Lastly, the Tines Docs cover email triggers and formula parsing in detail and are also a helpful resource.