# KnowBe4 PhishER Email Analysis

> Agent-empowered n8n workflow that pulls outstanding reported emails from PhishER for AI-driven analysis, tagging, and comment submission.

- Type: Playbook
- Author: disassembledd
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Source repository: https://github.com/disassembledd/knowbe4-phisher-email-analysis
- Repo state: not archived
- Last push: 2026-07-06T17:07:57Z
- Stars: 4 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: KnowBe4
- Domains: email-collaboration-security
- Tags: knowbe4, phisher, email-analysis, n8n
- Date added: 2026-07-01
- Playbook type: n8n
- Listing page: https://exchange.tenable.com/playbooks/knowbe4-phisher-email-analysis
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/playbooks/knowbe4-phisher-email-analysis.md

This is an agent-empowered n8n workflow that pulls outstanding reported emails from the KnowBe4 PhishER platform for AI-powered analysis. It assesses whether each email is a threat, spam, or clean, then submits a verdict tag and detailed comment back to PhishER.

## What it does

Analyzes the contents of reported emails — including embedded images, attachments, and body text — to determine whether they represent a genuine phishing threat, spam, or a clean message. Results are automatically posted back to PhishER as comments and classification tags.

## How it works

The workflow runs on a 5-minute schedule, pulling unprocessed messages from PhishER via GraphQL API. Each email is parsed (including MIME decoding, image extraction, and attachment handling) and sent to Claude on AWS Bedrock for multimodal analysis. The AI verdict and confidence score are posted back as a comment and tag on the original PhishER message.

## Setup

Requires an n8n instance with `mailparser`, `htmlparser2`, `domutils`, and `dom-serializer` installed in the runner environment. Configure credentials for KnowBe4 PhishER API (bearer token) and AWS Bedrock (for Claude access). See the repository README for detailed deployment instructions.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/playbooks/knowbe4-phisher-email-analysis.json. The full index and how to read it: https://exchange.tenable.com/llms.txt