Programmable email security behind your gateway

Gateway auto-triage is a black box you cannot patch

The endpoints that solve it

A two-lane pipeline: hot path + escalation

import os, base64, requests

API = "https://api.dfir-lab.ch"
H = {"Authorization": f"Bearer {os.environ['DFIR_API_KEY']}"}

def triage(raw_eml_bytes: bytes) -> dict:
    # Hot path: 1 credit, sub-second latency
    r = requests.post(
        f"{API}/v1/phishing/analyze",
        headers=H,
        json={"raw_email": base64.b64encode(raw_eml_bytes).decode()},
        timeout=10,
    )
    verdict = r.json()
    if verdict["risk_score"] < 70:
        return verdict  # done — log and move on

    # Escalation lane: AI adjudication + full IOC enrichment
    ai = requests.post(
        f"{API}/v1/phishing/analyze/ai",
        headers=H,
        json={"raw_email": base64.b64encode(raw_eml_bytes).decode()},
        timeout=30,
    ).json()

    iocs = verdict["indicators"]
    enrichment = requests.post(
        f"{API}/v1/enrichment/lookup",
        headers=H,
        json={"indicators": iocs},
        timeout=30,
    ).json()

    return {"verdict": verdict, "ai": ai, "enrichment": enrichment}

1. 01
   Step 01

   Ingest

   Gateway quarantine, user-report mailbox, or transport rule BCC. Any source of raw .eml works — no vendor-specific connector required.

2. 02
   Step 02

   Hot path

   POST /v1/phishing/analyze for every message. Deterministic, cheap, safe to run in-line with your own queue.

3. 03
   Step 03

   Threshold + escalate

   Risk score above your threshold? Fan out to /v1/phishing/analyze/ai and /v1/enrichment/lookup. Everything else just gets logged.

4. 04
   Step 04

   BEC playbook

   When your IdP flags anomalous sign-ins, call /v1/bec/forwarding-audit and /v1/bec/timeline for the affected mailbox. Attach both JSONs to the incident ticket.

5. 05
   Step 05

   Own the output

   All responses are plain JSON — no UI to depend on. Index into Splunk, post to Slack, push to Jira, diff across days. Your pipeline, your rules.

Pricing that tracks your workload

1. 01

   Small team — 200 emails/week hot path, 10% escalate

   (200 × 4 × 1) + (20 × 4 × 10) + (100 × 4 × 3) = 800 + 800 + 1,200 = 2,800 credits/month

   Fits Professional ($99/mo, 2,500 credits) plus a small 500-credit top-up ($35), or Starter + 3,000-credit top-ups if volume is bursty.
2. 02

   Mid-size org — 1,000 emails/week hot path, 15% escalate, 2 BEC cases/mo

   (1,000 × 4 × 1) + (150 × 4 × 10) + (600 × 4 × 3) + (2 × (5 + 10)) = 4,000 + 6,000 + 7,200 + 30 = 17,230 credits/month

   Exceeds Professional on credits. Either stack credit top-ups or move to Enterprise for unlimited usage and a committed SLA.
3. 03

   Small dev-team pilot — 50 emails/week all deterministic, no AI

   50 × 4 × 1 = 200 credits/month

   Fits Free ($0, 100 credits) for the first half of the month; Starter ($29/mo, 500 credits) covers the full month with room for ad-hoc IOC enrichment.

Three ways to evaluate

Frequently asked

Q / 01

How is this different from the SOC phishing triage use case?

Same endpoints, different audience. The SOC page is written for the analyst using a finished pipeline. This page is for the engineer building and owning that pipeline — so it covers determinism, idempotency, BEC automation, and how the pieces compose into a larger email-security system.

Q / 02

Can I replace my gateway with this?

No — and you should not want to. Gateways do inline SMTP-layer blocking; the DFIR Platform is a post-delivery programmable layer. They are complementary. If anything, a good programmable layer lets you keep a cheaper gateway.

Q / 03

What does 'deterministic' actually mean here?

The /v1/phishing/analyze endpoint is rule-based: same raw email in, same JSON out. The risk score does not drift because a model retrained overnight. The AI endpoints are explicitly separate so you can cache, retry, and audit the deterministic layer with confidence.

Q / 04

Do the BEC endpoints require tenant admin access?

Yes — forwarding-rule and sign-in timeline data only exist inside your identity provider (M365, Google Workspace). You authorize access once under your tenant; the endpoints then expose the data in a normalized JSON shape consistent across IdPs.

Q / 05

Can I run this inside my SOAR (Tines, n8n, Cortex XSOAR, Splunk SOAR)?

Yes — every endpoint is HTTP + JSON with bearer auth. Any SOAR with a generic HTTP block works. Most teams wrap the hot-path + escalation pattern into a single sub-workflow and call it from their gateway and mailbox playbooks.

Q / 06

What about data residency?

SaaS defaults to EU processing. Enterprise customers with hard data-residency requirements can deploy on-premise; ask for an Enterprise quote.