Browse workflow ideas

Give security teams a clearer view of suspicious emails.

Illustrative idea, not a published runnable template. Grunt is prelaunch; live service is paused and live provider connections and outcomes remain unverified. The steps, providers, and outcomes below describe a concept.

Bring the message, its visible appearance, and delivery details together so a security analyst can review possible phishing indicators in context. Prepare a concise incident summary and supporting image for the team, keeping decisions about the message and any follow-up with a human reviewer.

Explore the simulation Explore the idea

Actual availability depends on published steps, supported connections, permissions, and provider approval.

Illustrative workflow and outcome

Email flagged for reviewA message in an approved work mailbox that needs a security check

“Organize the message and its delivery details, highlight possible phishing signals, and prepare a review record without deciding what happens to the email.”

Work through the request.

Clear tasks, with review where it matters.

Select a message for security review
Preserve the original message context
Review the message as it appears

See all 6 tasks

A source-linked security case with the message appearance and possible warning signs ready for analyst review.

What this workflow could do

Helps security teams assess suspicious email using both the message content and how it appears to the recipient.

Review points proposed in this idea

Email content and attachments can contain personal or confidential information, and a visual or security assessment can be wrong. Limit access and retention, preserve the original for an authorized analyst, and require a person to decide whether to block, report, delete, or contact anyone about the message.

How the idea could work

Select an illustrative task to explore its proposed role. No workflow runs here.

Confirm that the message is in scope and that the reviewer is authorized to inspect its contents and delivery details.

Step 1 of 6

Select a message for security review

Confirm that the message is in scope and that the reviewer is authorized to inspect its contents and delivery details.

Proposed setup considerations

These are planning notes for the concept, not instructions for a currently available template.

01
Choose mailboxes and messages in scope
Define which work mailboxes and message types may be reviewed and who is allowed to inspect them.
02
Set privacy and evidence handling rules
Limit access to message content and images, decide what evidence is retained, and follow the organization’s retention requirements.
03
Choose the security review destination
Select a restricted incident queue and identify the responders responsible for assessing possible phishing.
04
Test common and uncertain examples
Review legitimate messages, obvious impersonation, suspicious links, and incomplete evidence; confirm no message is blocked or reported without a person’s decision.