Cortex Advanced Email Security module overview - Learn how to onboard, configure, and operate the Email Security module. - Administrator Guide - Cortex XDR - Cortex - Security Operations

Our API-based email ingestion method ensures comprehensive data collection with minimal operational overhead.

The detection engine combines traditional heuristics, rule-based logic, and large language model (LLM) analysis for deeper message understanding.

Phishing attempt reports are collected in a dedicated inbox. Reported messages are then ingested  as additional input to the detection pipeline and optionally correlated with existing threats.

Issues are enriched with the following:

When the module identifies an email threat, it initiates a series of response mechanisms to neutralize the threat and protect users. Automated and manual actions include message removal, sender blocking, allowlisting, tagging false positives. Action execution is tracked per message and per user, with rollback capability where supported.

The module groups email issues into cases based on shared indicators or behavioral similarities (e.g., identical links across multiple users, same impersonation theme). This enables centralized investigation of broader campaigns.

The Email Command Center provides real-time visualization of email threat activity, issue trends, policy effectiveness, and user-based risk profiles.

In environments with extended visibility (e.g., endpoint, identity), issues are enriched with cross-domain signals to support attack path reconstruction and unified incident handling.

The Email Investigation agent is an AI-powered agent available with the Advanced Email Security module that enables you to investigate user-reported phishing and suspicious emails through a conversational interface. It leverages LLM capabilities to analyze email metadata, understand why messages were flagged, assess threat indicators, and recommend appropriate next steps for triage, investigation, or remediation.

To open the agent, click the Agentic Assistant button on the top right of any screen and select the Email Investigation agent. Use the agent to ask questions relating to email security.

Here are some of the benefits of using the Email Investigation agent: