{
  "type": "playbook",
  "slug": "email-analyst-in-a-box",
  "name": "Email-Analyst-in-a-box",
  "author": "austinsr1",
  "description": "Eight-stage local triage chain for user-reported phishing, with a human checkpoint before every external mutation and an offline runner that enforces the contract.",
  "github_url": "https://github.com/austinsr1/assay",
  "license": "MIT",
  "tier": "contributed",
  "tags": [
    "phishing",
    "email-security",
    "triage",
    "local-inference",
    "playbook"
  ],
  "integrations": [
    "GCP"
  ],
  "domains": [
    "email-collaboration-security",
    "security-operations"
  ],
  "date_added": "2026-11-04",
  "last_reviewed": "2026-11-04",
  "works_with_tenable_hexa_mcp": false,
  "playbook_type": "standard",
  "agents_used": [
    {
      "name": "Phish Triage Orchestrator",
      "role": "Carries the eight-stage chain end to end and holds no external write tools.",
      "type": "github",
      "ref": "https://github.com/austinsr1/assay"
    },
    {
      "name": "Phish Triage MCP Server",
      "role": "Provides the typed tools the chain binds to: intake, parse, classify, adjudicate, verify.",
      "type": "github",
      "ref": "https://github.com/austinsr1/assay"
    }
  ],
  "repo": {
    "found": true,
    "archived": false,
    "pushed_at": "2026-11-05T01:18:51Z",
    "stars": 0,
    "forks": 0,
    "open_issues": 0,
    "owner_type": "user",
    "language": "Python",
    "checked_at": "2026-11-05T20:35:15.821Z"
  },
  "url": "https://exchange.tenable.com/playbooks/email-analyst-in-a-box",
  "json_url": "https://exchange.tenable.com/api/playbooks/email-analyst-in-a-box.json",
  "markdown_url": "https://exchange.tenable.com/playbooks/email-analyst-in-a-box.md",
  "source_url": "https://github.com/tenable/cyberagents-exchange/blob/main/playbooks/email-analyst-in-a-box.md"
}