This workflow automatically receives emails from an IMAP mailbox, uploads the emails and their attachments to the security incident response platform TheHive, and automatically generates and manages security incidents. It utilizes the Cortex security analysis engine for in-depth threat intelligence analysis of the attachments and related indicators. This process significantly reduces the burden of manual screening and enhances the ability to quickly respond to and accurately identify potential attack threats, making it suitable for security operation centers and enterprise email security monitoring.
Workflow Name
Key Features and Highlights
This workflow automates the retrieval of emails from an IMAP mailbox, uploading the emails and their attachments to the security incident response platform TheHive. It automatically creates and manages security incidents (Cases) and integrates with the Cortex security analysis engine to perform in-depth threat intelligence analysis on email attachments and related indicators (domains, email addresses, IPs). The analysis results enrich the security incident data, assisting security teams in quickly identifying and responding to potential attack threats.
Core Problems Addressed
- Automates processing of large volumes of email security threats, reducing manual screening workload.
- Rapidly extracts threat indicators (IOCs) from emails and performs multidimensional security analysis.
- Automatically creates and updates security incidents for efficient incident management and tracking.
- Feeds security analysis results back into incidents promptly, enhancing response speed and accuracy.
Use Cases
- Automated threat detection and response in Security Operations Centers (SOC).
- Enterprise email security threat monitoring and incident management.
- Automated threat intelligence processing workflows integrating TheHive and Cortex.
- Scenarios requiring security analysis of email attachments and associated information.
Main Workflow Steps
- Automatically read emails and attachments from the mailbox via the IMAP node.
- Upload email information and attachments to TheHive, creating corresponding Artifacts.
- Automatically promote Artifacts to security incidents (Cases).
- Query and wait for the security incident to be ready.
- Retrieve the list of Observables (suspicious indicators) within the incident.
- Execute Cortex analyzers on email attachments to obtain threat intelligence reports.
- Determine whether the reports contain IOCs such as domains, email addresses, or IPs.
- Create Observables for different IOCs and invoke corresponding Cortex analyzers (e.g., OTX domain/IP analyzers, email reputation analyzers).
- Update analysis results back into the security incident to support subsequent investigations by the security team.
Involved Systems or Services
- IMAP Email: For email retrieval.
- TheHive: Security incident management platform used for creating and updating incidents and Observables.
- Cortex: Security analysis engine executing various threat analyzers (e.g., email attachment analysis, OTX threat intelligence queries).
- Workflow control and data synchronization are achieved via Webhook and wait nodes.
Target Audience and Value
- SOC analysts and automation engineers.
- Enterprise security teams aiming to improve email threat detection and response efficiency.
- Organizations seeking to build automated security incident management and threat intelligence analysis workflows.
- Enhances security posture by shortening threat response times through automated analysis.