Triage reported phishing in Slack
When someone reports a suspicious message in Slack, assesses it for phishing indicators, replies in thread and logs it.
Apps it connects
Authenticate each one once and the workflow is ready to run.
What it does
The integration steps this workflow runs, in the order it first runs them.
- 1SlackNew message trigger
- 2AnthropicGenerate model response
- 3SlackSend message
- 4Google SheetsAppend row
How it works
Everything the template sets up, and what to fill in before the first run.
People notice suspicious email long before any tool does, but reporting it is usually where the trail goes cold. This workflow runs the moment someone posts a report into your security channel: it reads what they pasted, assesses it against the usual phishing indicators - sender mismatch, lookalike domains, urgency and threat language, credential or payment requests, mismatched links, unexpected attachments - and replies in their thread with a risk level, what it saw, and what to do next.
It is deliberately written as a first pass, not a verdict. It is told never to call anything definitely safe, and to answer MEDIUM rather than LOW when there is not enough to go on, because the cost of waving through a real phish is far higher than the cost of a second look. Every reply says so.
Every report is logged to a spreadsheet with the reporter, the original text and the verdict, whatever the assessment said. The log is the point: it is what makes a wrong call findable afterwards and what turns scattered reports into something you can review.
To set it up, choose the Slack channel people report into on the trigger step, and paste the spreadsheet to log to.
You May Also Be Interested In
Log what your mail's headers record about where it came fromReads the headers of the inbound mail you name and logs the SPF, DKIM and DMARC results and where each relay address resolves.
Look up an unfamiliar website before you deal with itGathers what public records, the web archive and search results say about a site you don't know, each with its source.
See what your incoming mail links toLists the hosts new mail links to, leaves out the ones you expect, adds what the public registry holds on each, and posts it to Slack.Warn before SSL certificates expireChecks the certificate on every domain in your sheet each morning and emails the ones running out of time to renew.
Start from a workflow that already works.
Add "Triage reported phishing in Slack" to your workspace, connect its apps, and make it yours. No credit card required.
Free plan available · No credit card required