Skip to Workflow Atlas
Playbook AtlasWorkflow Atlas
Index held / follow enabledBrowse archive
Event-Driven AutomationIntermediate

Phishing URL Analysis with URLScan & VirusTotal

Phishing URL Analysis with URLScan & VirusTotal is a 16-node automation blueprint connecting VirusTotal, URLScan.io, Slack. Inspect its trigger, execution graph, branches, and implementation requirements.

VirusTotalURLScan.ioSlackMicrosoft Outlook

Live system map / verified archive

The entire automation, wired and inspectable.

Brand marks identify the operational stack. Focus or select any node to isolate its real incoming and outgoing connections.

16

Nodes

19

Edges

6

Zones

System stack

4 integrations

  • VirusTotal
  • URLScan.io
  • Slack
  • Microsoft Outlook
Phishing URL Analysis with URLScan & VirusTotal interactive execution graphStructural view of 16 workflow nodes and 19 visible connections. Focus any node to inspect its connected path. Parameters and credentials are intentionally excluded.Schedule Trigger. trigger node, scheduleTrigger. 0 incoming and 1 outgoing connections.Schedule TriggerTRIGGERSCHEDULETRIGGER0 IN / 1 OUTWhen clicking "Execute Workflow". trigger node, manualTrigger. 0 incoming and 1 outgoing connections.When clicking "Execute Wo…TRIGGERMANUALTRIGGER0 IN / 1 OUTGet all unread messages. integration node, microsoftOutlook. 2 incoming and 1 outgoing connections.Get all unread messagesINTEGRATIONMICROSOFTOUTLOOK2 IN / 1 OUTMark as read. integration node, microsoftOutlook. 1 incoming and 1 outgoing connections.Mark as readINTEGRATIONMICROSOFTOUTLOOK1 IN / 1 OUTSplit In Batches. integration node, splitInBatches. 3 incoming and 2 outgoing connections.Split In BatchesINTEGRATIONSPLITINBATCHES3 IN / 2 OUTFind indicators of compromise. transform node, code. 1 incoming and 1 outgoing connections.Find indicators of compro…TRANSFORMCODE1 IN / 1 OUTHas URL?. decision node, if. 1 incoming and 3 outgoing connections.Has URL?DECISIONIF1 IN / 3 OUTNot empty?. decision node, filter. 1 incoming and 1 outgoing connections.Not empty?DECISIONFILTER1 IN / 1 OUTURLScan: Scan URL. integration node, urlScanIo. 1 incoming and 1 outgoing connections.URLScan: Scan URLINTEGRATIONURLSCANIO1 IN / 1 OUTVirusTotal: Scan URL. integration node, httpRequest. 1 incoming and 1 outgoing connections.VirusTotal: Scan URLINTEGRATIONHTTPREQUEST1 IN / 1 OUTsends slack message. Slack node, slack. 1 incoming and 0 outgoing connections.sends slack messageSLACKSLACK1 IN / 0 OUTWait 1 Minute. integration node, wait. 1 incoming and 1 outgoing connections.Wait 1 MinuteINTEGRATIONWAIT1 IN / 1 OUTNo error?. decision node, if. 1 incoming and 2 outgoing connections.No error?DECISIONIF1 IN / 2 OUTVirusTotal: Get report. integration node, httpRequest. 1 incoming and 1 outgoing connections.VirusTotal: Get reportINTEGRATIONHTTPREQUEST1 IN / 1 OUTURLScan: Get report. integration node, urlScanIo. 1 incoming and 1 outgoing connections.URLScan: Get reportINTEGRATIONURLSCANIO1 IN / 1 OUTMerge Reports. decision node, merge. 3 incoming and 1 outgoing connections.Merge ReportsDECISIONMERGE3 IN / 1 OUT

Signal inspector

Focus, hover, or select a node to illuminate its real path.

triggeraidecisiontransformintegration
Scroll horizontally to inspect every zone.verified structural metadata · graph 80578cfa8265b2fbEnter or click to lock · Escape to clear

Structured review

Read the workflow as a system, not a node dump.

The archived graph is grouped into operational zones, then checked against the controls needed to adapt the pattern safely. Every count below is derived from the normalized record.

01

Entry signals

2 nodes

Events, schedules, and unconnected roots that can start an execution.

When clicking "Execute Workflow"

Trigger

Schedule Trigger

Trigger

02

Data & operations

9 nodes

Transformations and external-system actions that move the work forward.

Split In Batches

Integration

Mark as read

Integration

VirusTotal: Scan URL

Integration

VirusTotal: Get report

Integration

Find indicators of compromise

Transform

URLScan: Get report

Integration

+ 3 more in system map
03

Intelligence & routing

4 nodes

Model calls and control points that interpret, branch, or govern the run.

Has URL?

Decision

No error?

Decision

Not empty?

Decision

Merge Reports

Decision

04

Terminal actions

1 node

Nodes with no visible outgoing edge: the workflow’s observable outcomes.

sends slack message

Integration

Provenance boundary

Inspectable does not mean redistributable.

This page publishes structural metadata extracted from a local workflow archive. Parameters, credential references, code bodies, and downloadable JSON are excluded. The route can enter indexing only after a graph match and quality gate; source licensing remains a separate promotion gate.

Graph match
prefix
Quality score
12 / 14
Raw download
Held
Crawler state
Follow

Adjacent systems

Keep tracing the stack.

Related records are ranked by shared integrations and graph quality.

Turn the map into a plan

Adapt this blueprint to your company.

Bring the system shape into a workspace, then define the production controls, data boundaries, owners, and delivery sequence around your context.

Create a build planReturn to the atlas