Skip to content

Investigation Workflow

Jump to bottom
LitapAI_Rohit edited this page Jul 8, 2026 · 1 revision

Investigation Workflow

MailIntel AI follows a structured investigation pipeline that transforms a raw RFC822 email into a comprehensive, evidence-driven investigation report.

The workflow is deterministic, explainable, and reproducible, ensuring that every conclusion is supported by collected evidence.

Workflow Overview

RFC822 Email (.eml)
        │
        ▼
Email Parsing
        │
        ▼
Investigation Initialization
        │
        ▼
Authentication Analysis
        │
        ▼
URL Intelligence
        │
        ▼
Language Intelligence
        │
        ▼
Evidence Collection
        │
        ▼
Finding Generation
        │
        ▼
Risk Calculation
        │
        ▼
Report Generation
        │
        ▼
Dashboard + PDF + JSON

Step 1 — Upload Email

The investigation begins when the user uploads an RFC822 (.eml) email file through the Streamlit dashboard.

Supported input:

  • RFC822 email (.eml)

The uploaded email becomes the source document for the investigation.

Step 2 — Email Parsing

The Email Parser extracts structured information from the message.

Examples include:

  • Subject
  • Sender
  • Recipient
  • Date
  • Headers
  • Body
  • Attachments (future enhancement)

The parser converts the raw email into an internal object that can be analyzed by downstream components.

Step 3 — Investigation Initialization

A new investigation is created with a unique identifier.

Metadata such as:

  • Investigation ID
  • Timestamp
  • Email filename

is recorded before analysis begins.

Step 4 — Authentication Analysis

Authentication headers are inspected to evaluate email authenticity.

Current checks include:

  • SPF
  • DKIM
  • DMARC

Authentication failures contribute to the overall investigation risk.

Step 5 — URL Intelligence

URLs embedded within the email are extracted and analyzed.

The module performs:

  • URL extraction
  • Domain identification
  • Suspicious indicator detection

Future versions may integrate external threat intelligence services for reputation analysis.

Step 6 — Language Intelligence

The email body is analyzed for linguistic indicators commonly associated with phishing and social engineering.

Examples include:

  • Urgency
  • Account verification requests
  • Password reset messages
  • Financial requests
  • Credential harvesting language

The goal is to identify persuasive patterns that warrant further investigation.

Step 7 — Evidence Collection

Evidence produced by each intelligence module is collected into a structured evidence set.

Examples:

  • Authentication failures
  • Suspicious URLs
  • Social engineering indicators

Evidence serves as the factual basis for the investigation.

Step 8 — Finding Generation

Evidence is transformed into investigator-friendly findings.

Example:

Finding:
Suspicious authentication configuration detected.

Supporting Evidence:
• SPF validation failed.
• DMARC policy missing.

Findings summarize the investigation in a concise and actionable manner.

Step 9 — Risk Calculation

The Explainable Risk Engine evaluates the collected evidence and calculates an overall investigation score.

The score reflects the cumulative impact of observed indicators rather than relying on opaque or arbitrary weighting.

Risk levels are presented as:

  • Low
  • Medium
  • High
  • Critical

Each level is supported by the corresponding evidence.

Step 10 — Report Generation

The finalized investigation is exported in multiple formats.

Executive PDF

Designed for analysts, managers, and stakeholders.

Contents include:

  • Investigation summary
  • Risk profile
  • Findings
  • Recommendations
  • Evidence overview

JSON Report

Designed for automation and integration.

Contents include:

  • Investigation metadata
  • Findings
  • Evidence
  • Risk information
  • Recommendations

This format supports downstream processing and system integration.

Step 11 — Dashboard Presentation

The Streamlit interface provides an interactive view of the investigation.

Users can:

  • Review investigation metadata
  • Explore evidence
  • Inspect language analysis
  • Download reports
  • Review recommendations

The dashboard acts as the primary interface for investigators.

Investigation Principles

MailIntel AI is built around four guiding principles.

Explainability

Every conclusion is traceable to supporting evidence.

Transparency

No hidden scoring mechanisms or unexplained decisions.

Reproducibility

The same email always produces the same investigation results.

Modularity

Each stage of the workflow operates independently, simplifying testing and future enhancements.

Future Workflow Enhancements

Planned improvements include:

  • Batch processing of multiple emails
  • Attachment analysis
  • HTML email rendering
  • Threat intelligence integration
  • IOC extraction
  • Investigation history
  • Collaborative case management
  • Automated alert generation

These enhancements will build upon the existing workflow without requiring significant architectural changes.

Clone this wiki locally