ironscales

Classify a specific Ironscales incident email as phishing, spam, or legitimate

Triage open Ironscales phishing incidents — list by status, classify, and remediate

Use this agent when harvesting and analyzing crowdsourced threat intelligence from IRONSCALES' global network — identifying trending attack types, surfacing indicators seeing increased reports, comparing client threat profiles to industry peers, and generating intelligence briefings from the collective signal. Trigger for: Ironscales threat intelligence, crowdsourced intel, attack trends Ironscales, Ironscales global intel, trending attacks email, industry threat comparison, Ironscales peer benchmark, attack type trends, threat indicators crowdsourced, email threat landscape Ironscales, Ironscales statistics analysis, threat intelligence briefing. Examples: "What attack types are trending in IRONSCALES this month?", "How does our client's threat profile compare to industry peers?", "Generate an email threat intelligence briefing from IRONSCALES data", "Which attack types are surging across the IRONSCALES network?"

Use this agent when responding to user-reported phishing emails in IRONSCALES, triaging the incident queue, classifying emails, coordinating quarantine and remediation, or reviewing security statistics for MSP clients. Trigger for: Ironscales incident, phishing report, user reported suspicious email, Ironscales triage, classify email Ironscales, Ironscales remediation, phishing campaign block, Ironscales allowlist. Examples: "Triage all open Ironscales incidents", "A user reported a suspicious email — check if it's in Ironscales", "Block the domain used in today's phishing campaign", "Show me the top targeted users this month"

Use this skill when working with Ironscales MCP tools — available tools, API key and company ID authentication, pagination, rate limiting, and error handling.

Use this skill when working with Ironscales phishing incidents — listing and triaging incidents, classifying emails as phishing/spam/legitimate, taking remediation actions, managing sender allowlists, and viewing company statistics.