How Auto-Triage Works

Understanding the pipeline helps you interpret verdicts in the Quarantine queue and tune your Policies.

Stages

1. Content classification — the email body, subject, and headers are classified (phishing, BEC, malware, spam, safe) with a confidence score.

2. Sender reputation — SPF/DKIM/DMARC are verified against the real headers, plus DNS and domain-reputation checks.

3. Link & attachment analysis — URLs and files are scored against reputation feeds and heuristics.

4. Graph intelligence — sender history, domain spread, and prior flags feed a per-sender reputation score.

5. Risk score — a weighted blend: content 40% + graph 30% + reputation 30%.

6. Verdict — Helios returns QUARANTINE, DISMISS, ESCALATE, or MARK_AS_SPAM.

7. Sandbox detonation — URLs/attachments are detonated in an isolated sandbox in the background; results attach to the threat record.

8. Action — the email is physically moved (quarantine / junk / inbox) via the Gmail or Graph API.

9. Learning — a FLAGGED_AS edge is written on quarantine, and retracted (reputation recomputed) if you release a false positive.

Verdicts

Verdict	Action
QUARANTINE	Moved out of the inbox; sender flagged
DISMISS	Clean; reinjected if user-reported
ESCALATE	Routed to a human analyst
MARK_AS_SPAM	Moved to spam/junk

Tip

Every verdict stores its rationale on the threat record, so analysts can audit exactly why an action was taken.