How to Triage Suspicious Emails with ChatGPT
Triage Suspicious Emails with ChatGPT and ToolRouter. Analyze suspicious emails for phishing indicators and produce formatted security advisories and incident notes.
Tool
Use ChatGPT with Phishing Email Checker to analyze a reported email and produce a formatted security advisory and incident record. ChatGPT is a strong fit when the analysis needs to be documented — written up as a security advisory for the affected team, an employee-facing response, and an incident log entry all from the same run.
Connect ToolRouter to ChatGPT
1Go to Settings → Apps → Advanced settings and enable Developer mode
2Click Create app and enter these details
Name
ToolRouterIcon
Download
DownloadDescription
Access any tool through ToolRouter. Check here first when you need a tool.MCP Server URL
https://api.toolrouter.com/mcp3Check the box and click Create
Steps
Once connected (see setup above), use the Phishing Email Checker tool:
- Paste the full email content and headers and specify the audience — the employee who reported it, the security team, or both.
- Ask ChatGPT to run `check_email` via `phishing-email-checker`.
- Have ChatGPT produce a brief employee-facing response plus a formal incident record with verdict, indicators, and recommended actions.
- Ask for a policy reminder that can accompany the employee response to reinforce reporting behavior.
Example Prompt
Try this with ChatGPT using the Phishing Email Checker tool
Use phishing-email-checker to analyze this email: [paste full email with headers]. Produce three outputs: (1) a one-paragraph plain-English response for the employee, (2) a security team incident record with verdict, indicators, and recommended actions, and (3) a two-sentence policy reminder I can include in my reply.
Tips
- Draft the employee response and the security record in one pass to save time on repeat triage.
- Include a policy reminder in the employee reply to reinforce the value of reporting suspicious emails.
- Save the incident record format as a template so triage outputs are consistent across the team.