Skip to Workflow Atlas
Playbook AtlasWorkflow Atlas
Workflow blueprintBrowse workflows
Event-Driven AutomationIntermediate

Phishing URL Analysis with URLScan & VirusTotal

Phishing URL Analysis with URLScan & VirusTotal is a 16-node automation blueprint connecting VirusTotal, URLScan.io, Slack. Inspect its trigger, execution graph, branches, and implementation requirements.

VirusTotalURLScan.ioSlackMicrosoft Outlook

Interactive system map

Follow the runtime. Inspect what supports it.

Solid horizontal paths show main-channel execution. Violet dependencies sit beneath the exact step they configure or empower.

16

Nodes

19

Links

1

Run groups

Connected tools

4 integrations

  • VirusTotal
  • URLScan.io
  • Slack
  • Microsoft Outlook

Canvas controls

Fit wide systems, then zoom into any run group.

Phishing URL Analysis with URLScan & VirusTotal execution lanes1 run groups containing 16 workflow nodes and 19 visible links. Solid horizontal lines are main-channel runtime links. Violet dashed lines connect typed dependencies beneath the runtime step they support. Focus any node to inspect its immediate path.Schedule Trigger. trigger node, scheduleTrigger. 0 incoming and 1 outgoing connections.STARTSchedule TriggerTRIGGERSCHEDULETRIGGER0 IN / 1 OUTWhen clicking "Execute Workflow". trigger node, manualTrigger. 0 incoming and 1 outgoing connections.STARTWhen clicking "Execute Wo…TRIGGERMANUALTRIGGER0 IN / 1 OUTGet all unread messages. integration node, microsoftOutlook. 2 incoming and 1 outgoing connections.STEP 02Get all unread messagesINTEGRATIONMICROSOFTOUTLOOK2 IN / 1 OUTMark as read. integration node, microsoftOutlook. 1 incoming and 1 outgoing connections.STEP 03Mark as readINTEGRATIONMICROSOFTOUTLOOK1 IN / 1 OUTSplit In Batches. integration node, splitInBatches. 3 incoming and 2 outgoing connections.STEP 04Split In BatchesINTEGRATIONSPLITINBATCHES3 IN / 2 OUTFind indicators of compromise. transform node, code. 1 incoming and 1 outgoing connections.STEP 05Find indicators of compro…TRANSFORMCODE1 IN / 1 OUTNot empty?. decision node, filter. 1 incoming and 1 outgoing connections.STEP 06Not empty?DECISIONFILTER1 IN / 1 OUTHas URL?. decision node, if. 1 incoming and 3 outgoing connections.STEP 07Has URL?DECISIONIF1 IN / 3 OUTsends slack message. Slack node, slack. 1 incoming and 0 outgoing connections.STEP 08sends slack messageSLACKSLACK1 IN / 0 OUTVirusTotal: Scan URL. integration node, httpRequest. 1 incoming and 1 outgoing connections.STEP 09VirusTotal: Scan URLINTEGRATIONHTTPREQUEST1 IN / 1 OUTURLScan: Scan URL. integration node, urlScanIo. 1 incoming and 1 outgoing connections.STEP 10URLScan: Scan URLINTEGRATIONURLSCANIO1 IN / 1 OUTVirusTotal: Get report. integration node, httpRequest. 1 incoming and 1 outgoing connections.STEP 11VirusTotal: Get reportINTEGRATIONHTTPREQUEST1 IN / 1 OUTNo error?. decision node, if. 1 incoming and 2 outgoing connections.STEP 12No error?DECISIONIF1 IN / 2 OUTWait 1 Minute. integration node, wait. 1 incoming and 1 outgoing connections.STEP 13Wait 1 MinuteINTEGRATIONWAIT1 IN / 1 OUTURLScan: Get report. integration node, urlScanIo. 1 incoming and 1 outgoing connections.STEP 14URLScan: Get reportINTEGRATIONURLSCANIO1 IN / 1 OUTMerge Reports. decision node, merge. 3 incoming and 1 outgoing connections.OUTCOMEMerge ReportsDECISIONMERGE3 IN / 1 OUT

Signal inspector

Focus, hover, or select a step to isolate its runtime and support links.

Main-channel runtimeTyped dependencytriggeraidecisiontransformintegration
Scroll horizontally to follow every connected flow.16 connected nodesEnter or click to lock · Escape to clear

Runtime breakdown

Read the execution spine before its dependencies.

Each run group separates main-channel steps from the models, tools, retrievers, and data services that support them. Start and outcome labels apply only to runtime nodes.

01

Run Group

Schedule Trigger

19 Execution Links

  1. Start

    Schedule Trigger

    Trigger

    When clicking "Execute Workflow"

    Trigger

  2. Step 2

    Get all unread messages

    Integration

  3. Step 3

    Mark as read

    Integration

  4. Step 4

    Split In Batches

    Integration

  5. Step 5

    Find indicators of compromise

    Transform

  6. Step 6

    Not empty?

    Decision

  7. Step 7

    Has URL?

    Decision

  8. Step 8

    sends slack message

    Integration

  9. Step 9

    VirusTotal: Scan URL

    Integration

  10. Step 10

    URLScan: Scan URL

    Integration

  11. Step 11

    VirusTotal: Get report

    Integration

  12. Step 12

    No error?

    Decision

  13. Step 13

    Wait 1 Minute

    Integration

  14. Step 14

    URLScan: Get report

    Integration

  15. Outcome

    Merge Reports

    Decision

Turn the map into a plan

Adapt this blueprint to your company.

Bring the system shape into a workspace, then define the production controls, data boundaries, owners, and delivery sequence around your context.

Create a build planReturn to the atlas