Things I built to do the job

Triaging a quarantined email is a tab-hopping exercise. The message sits in one portal, the headers need decoding somewhere else, the sender reputation lives at a third site, the recipient's job title is in a directory, and the attachment cannot safely be opened anywhere at all.

Every one of those steps is mechanical. Doing them by hand is slow, and being slow is how a genuine phish sits in quarantine for two days while somebody works through the queue.

MEG-A-DAHF collapses the whole investigation into one screen. Search the quarantine, open a message, and it assembles the headers, authentication results, recipient profile, URL reputation, message trace and impact analysis in one pass — then lets you detonate the attachment in an isolated machine and export a signed PDF of what you found.

It is a PowerShell 7 HTTP listener bound to localhost serving a vanilla JavaScript single-page frontend, with a WPF launcher that hides the console and shows worker health. No framework, no build step, no service to install — it is a script you run.

Three workers, so the UI never blocks

A round trip to Exchange Online takes seconds, and a UI that freezes for seconds is a UI people stop trusting. The server keeps three long-lived Exchange runspaces alive and routes work to them by kind: one for search, one for investigation and actions, one for enrichment. Nothing waits behind anything else, and the connection cost is paid once at startup rather than on every request.

Two detonation targets

Attachments and links are detonated in either Windows Sandbox — generated as a .wsb on demand — or a VMware guest, online or offline. The sandbox payload ships an embedded Python and 7-Zip so it works with no network at all, which matters when the whole point is to deny the sample a route out.

The scanner inside recursively extracts and hashes archive, spreadsheet and PDF content, hunts for executables, harvests every URL, and scores files, URLs and host IPs against VirusTotal, urlscan.io and AbuseIPDB.

• Hash-only lookups. It never uploads the sample and never fetches a URL.
• A failed lookup scores "unknown", never "clean" — silence is not evidence of safety.
• Every scan is private; nothing is submitted to a public corpus.

A knowledge base the team actually shares

Verdicts are worth nothing if they live in one person's head. Known-bad senders and chronically false-positive domains go into a shared, file-per-entry knowledge base on synced storage, with atomic writes and automatic conflict handling so two analysts working at once cannot clobber each other. A known sender shows up as a red badge on the result card before you have opened anything.

Released and denied decisions store a frozen snapshot of the entire investigation — every card, the recipient profile, the message preview, the generated PDF — replayable read-only months later. After archiving a decision the tool re-reads the message and nags if the action was never actually performed, which turns out to be the single most useful feature in it.

• Full investigation assembled in one screen instead of six tabs.
• Attachment detonation without leaving the tool.
• A "HIGH CONFIDENCE PHISHING INVESTIGATION" PDF generated client-side.
• On-device translation of subjects and previews.
• Expiry colour-coded so nothing quietly ages out of quarantine.

The other lesson was about honesty in scoring. An early version treated a failed reputation lookup as a pass, because that kept the UI green and tidy. That is a lie with a security consequence: it turns an outage at a third-party API into a clean bill of health. Unknown is now a first-class verdict and it renders as its own colour.