Lab: Triage a Suspicious Email with AI
Now you put it all together. In this hands-on lab you'll run a real triage workflow on fictional emails, using AI as your analyst partner to reach a verdict and a recommended action. This is the exact loop a Security Operations Center runs on reported emails every day, simplified so a beginner can do it in minutes.
What You'll Learn
- A repeatable four-step phishing triage workflow
- A reusable triage prompt that produces a verdict and next step
- How to handle three different emails: malicious, safe, and genuinely ambiguous
- How to record your decision so a teammate can follow your reasoning
The Triage Workflow
Professional triage follows a simple loop. Memorize these four steps:
- Capture — Get the full email, including the real sender address and the real link destinations. Sanitize any private data first (Lesson 3).
- Analyze — Ask AI to list red flags and reason about them, while you cross-check against the six-part anatomy.
- Decide — Reach a verdict: Safe, Suspicious, or Malicious. AI advises; you decide.
- Act & Record — Recommend the next step (delete, report, warn users, block sender) and write a short note explaining why.
Your Reusable Triage Prompt
Save this. It's the workhorse of the whole lab:
Role: You are a SOC analyst triaging a reported email.
Task: Analyze the email below for phishing.
Context: An employee reported it as suspicious. I have already
replaced any private data with placeholders.
Format:
1) Verdict: Safe / Suspicious / Malicious
2) Red flags: bullet list grouped by sender, subject, body, links
3) Confidence: Low / Medium / High, with one sentence why
4) Recommended action: one clear next step
Keep the whole answer under 200 words.
Email:
[paste the sanitized email]
Sample 1: The Obvious Phish
Paste this fictional email into the prompt above:
From: "IT Helpdesk" <helpdesk@it-support-secure.info>
Subject: [URGENT] Your password expires TODAY - reset now
Dear User,
Our system shows your email password expires in 2 hours. To avoid
losing access, reset it now: http://it-support-secure.info/reset
Ignore this and you will be locked out permanently.
IT Team
Run it. You should get a Malicious verdict with High confidence: external look-alike domain, extreme urgency, generic greeting, threat of lockout, and a password-reset link that doesn't go to your real provider. Recommended action: don't click, report to your security team, and warn colleagues who may have received it. Notice how fast the AI produced a clean, report-ready answer.
Sample 2: The Legitimate Email
Triage isn't only about catching bad emails, it's about not crying wolf on good ones. Paste this:
From: "GitHub" <noreply@github.com>
Subject: [GitHub] A new SSH key was added to your account
Hi octocat,
A new SSH key was added to your account. If you did this, no action
is needed. If you didn't, review your security settings here:
https://github.com/settings/keys
Thanks, The GitHub Team
The AI should lean Safe / low-risk: the sender domain matches the real service, the link points to the genuine domain, there's no urgency or threat, and the greeting uses the account name. The right action is usually "no action needed, but confirm the user recognizes the SSH key." Getting comfortable clearing legitimate mail is just as important as catching the bad ones, because false alarms waste everyone's time.
Sample 3: The Ambiguous One
Real life is often gray. Paste this:
From: "Sarah Chen" <sarah.chen@acme-partners.co>
Subject: Quick favor before my meeting
Hi, I'm heading into a meeting and can't talk. Can you help me
sort out a vendor payment? I'll send details shortly. It's a bit
time sensitive. Thanks, Sarah
There are no links or attachments, so nothing obviously "clicks wrong." But the pattern (a payment request, urgency, "can't talk right now," an unfamiliar external domain) matches business email compromise. The correct verdict is Suspicious, and the correct action is to verify out of band: contact Sarah through a known phone number or channel, not by replying. Ask your AI:
This email has no links or attachments. Why might it still be
dangerous, and what is the safest way to verify the request?
The AI should explain BEC and recommend out-of-band verification. This is the lesson that saves real money: the most dangerous phishing often has no link at all.
Record Your Decision
Finish every triage with a short, shareable note. Ask the AI:
Write a 3-line triage note for our ticket system: verdict, top two
reasons, and the action taken. Neutral, professional tone.
A tidy record means the next analyst (or your manager) can follow your reasoning in seconds. This is what "good triage" looks like in practice.
Practice on Your Own
Grab any email from your own spam folder (spam only, never real private mail), sanitize the addresses, and run the triage prompt. Do five and you'll start predicting the AI's verdict before you hit Enter, which means you're building real analyst instincts.
Key Takeaways
- Triage follows four steps: Capture, Analyze, Decide, Act & Record.
- Use one reusable prompt that returns a verdict, red flags, confidence, and a next step.
- Clearing legitimate email correctly matters as much as catching malicious email.
- The most dangerous phishing (business email compromise) often has no link at all; verify payment or credential requests out of band.
- Always finish with a short triage note so your reasoning is recorded and shareable.