Triage reported phishing in Slack
When someone reports a suspicious message in Slack, assesses it for phishing indicators, replies in thread and logs it.
Apps it connects
Authenticate each one once and the workflow is ready to run.
What it does
Each integration step this workflow runs, in order, what it is for, and the conditions and loops that decide when it runs.
- 1SlackNew message triggerStarts a run whenever someone posts a message in the Slack channel you chose for reporting suspicious mail.
- 2AnthropicGenerate model responseAsks the AI for a first pass on the report: a risk level, the indicators it saw and what to do next.
- 3SlackSend messageReplies in the reporter's thread with the verdict and a reminder that it is automated, not a final determination.
- 4Google SheetsAppend rowAppends one row per report to the 'Reports' tab with the time, reporter, channel, original text and verdict.
How it works
What happens on each run, in plain English.
Whenever someone posts a suspicious message into your security channel in Slack, the report is read and assessed by AI against the usual phishing indicators: sender mismatch, lookalike domains, urgency and threat language, requests for credentials or payment, mismatched links and unexpected attachments. A reply is posted in their thread with a risk level, what was seen and what to do next.
It is written as a first pass, not a verdict. The AI is told never to call anything definitely safe, and every reply says it is an automated assessment and that anything in doubt should be treated as suspicious and escalated. Every report is also logged to a spreadsheet with the time, the reporter, the original text and the verdict, so a wrong call can be found afterwards and scattered reports become something you can review. A report with no text is left alone.
You need a Slack channel people report into and a spreadsheet with a 'Reports' tab to log to.
You may also be interested in
Record where incoming emails really came fromFor the emails your Gmail search picks out, logs whether each passed the sender checks and which servers it really came through.
Turn regulatory updates into tracked tasksReads the official sources you list each day, summarises every new or amended rule, and files a task for each one.
Look up an unfamiliar website before you deal with itGathers what public records, the web archive and search results say about a site you don't know, each with its source.Watch your websites for downtimeChecks every site listed in a spreadsheet on a schedule and alerts you in Slack or by email when one goes down or recovers.Start from a workflow that already works.
Add "Triage reported phishing in Slack" to your workspace, connect its apps, and make it yours.
Free plan, no credit card