Triage reported phishing in Slack

Whenever someone posts a suspicious message into your security channel in Slack, the report is read and assessed by AI against the usual phishing indicators: sender mismatch, lookalike domains, urgency and threat language, requests for credentials or payment, mismatched links and unexpected attachments. A reply is posted in their thread with a risk level, what was seen and what to do next.

It is written as a first pass, not a verdict. The AI is told never to call anything definitely safe, and every reply says it is an automated assessment and that anything in doubt should be treated as suspicious and escalated. Every report is also logged to a spreadsheet with the time, the reporter, the original text and the verdict, so a wrong call can be found afterwards and scattered reports become something you can review. A report with no text is left alone.

You need a Slack channel people report into and a spreadsheet with a 'Reports' tab to log to.

SlackWhen someone posts in a channel. Save it as report.When someone posts in a channel. Save it as report.

Set logSheetUrl to blank.Set logSheetUrl to blank.

Set logTab to Reports.Set logTab to Reports.

Trim report.text and save it as reportText.Trim report.text and save it as reportText.

If reportText is emptyIf reportText is empty

Yes

Finish the run: The report had no text to assess, so nothing was done.Finish the run: The report had no text to assess, so nothing was done.

No

No steps

ClaudeAsk Claude: 'You are doing a FIRST-PASS triage of a message someone reported as suspicious. You are not the final word and must not say anything is definitely safe.Ask Claude: 'You are doing a FIRST-PASS triage of a message someone reported as suspicious. You are not the final word and must not say anything is definitely safe. Reply in exactly this shape: RISK: one of HIGH, MEDIUM, LOW WHY: one sentence naming the specific indicators you saw DO: one sentence telling the reporter what to do next Judge on observable indicators only - sender mismatch, lookalike domains, urgency or threat language, credential or payment requests, mismatched or shortened links, unexpected attachments. If there is not enough to go on, say so and use MEDIUM rather than guessing LOW. The reported message: reportText'. Save it as assessment. Maximum response length: 300

Trim assessment.response_text and save it as verdict.Trim assessment.response_text and save it as verdict.

SlackReply in a thread in report.channel_id.Reply in a thread in report.channel_id. Reply To: report.message_ts*Automated first-pass triage* verdict _This is an automated assessment, not a final determination. If in doubt, treat it as suspicious and escalate._

Google SheetsAdd a row to logTab in logSheetUrl.Add a row to logTab in logSheetUrl.