POST: Email Archival, Processing and Flagging Stack for Incident Responders

TL;DR

POST is a serverless email forensics platform that archives, processes, and flags emails using NLP and ML, enabling quick malicious content search and reducing costs significantly.

Contribution

The paper introduces POST, a novel API-driven serverless workflow for email archival, analysis, and flagging tailored for incident responders.

Findings

Enables fast search of email content for malicious indicators.

Uses NLP and ML for effective email flagging.

Achieves up to 68.6% cost savings.

Abstract

Phishing is one of the main points of compromise, with email security and awareness being estimated at \$50-100B in 2022. There is great need for email forensics capability to quickly search for malicious content. A novel solution POST is proposed. POST is an API driven serverless email archival, processing, and flagging workflow for both large and small organizations that collects and parses all email, flags emails using state of the art Natural Language Processing and Machine Learning, allows full email searching on every aspect of an email, and provides a cost savings of up to 68.6%.