Agentic AI Pipeline for Phishing Detection, Investigation, and Response

Phishing remains one of the most common and high-impact threats affecting organizations using Microsoft 365, often serving as an entry point for credential theft, malware delivery, and business email compromise. Security Operations Center (SOC) teams must manually triage large volumes of phishing-related alerts by extracting indicators of compromise, validating them through threat intelligence sources, correlating contextual evidence, and producing incident reports. This process is repetitive, time-consuming, and can lead to inconsistent classification and delayed response.

This project will develop an Email Investigator Agent that automates key phishing triage activities, including alert ingestion from Microsoft 365 Defender, indicator extraction and normalization, multi-source threat intelligence enrichment, and LLM-assisted classification. The system will generate structured SOC-ready incident reports with evidence-based severity scoring, classification rationale, and recommended response actions, while distinguishing phishing attempts from spam and benign email traffic.

Designed as a decision-support tool, the solution will keep analysts in control while reducing manual workload, improving consistency, and enabling more scalable phishing detection and response operations.

Faculty Supervisor:

Mohammad Tayebi

Student:

Partner:

GlassHouse Systems

Discipline:

Computer science

Sector:

Information and cultural industries; Manufacturing; Professional, scientific and technical services

University:

Simon Fraser University

Program: