Only Shield Admins with the Superuser or Administrator role may create, modify, or delete workflows and workflow templates.
Workflow Conditions
| SECTION | CONDITION | DEFINITION |
| Attachments | Attachment Count | Checks the number of attachments in an email |
| Attachment Filenames | Checks the names of attachments in an email | |
| Attachment Sizes | Checks the size of attachments in an email | |
| Attachment Types | Checks the MIME types of attachments in an email | |
| Decision | Decision Action | Checks the action of a decision in a workflow |
| Decision Risk Level | Checks the risk level of a decision in a workflow | |
| Envelope | HELO host | Checks the HELO host value in the SMTP transaction |
| SMTP Mail From | Checks the SMTP envelope (MAIL FROM) address | |
| SMTP Recipients | Checks the SMTP envelope (RCPT TO) addresses | |
| Headers | Any Sender Address | Checks any sender address of the email, including From, Reply-To, and Mail From |
| Any Sender Name | Checks any sender name of the email, including From and Reply-To headers | |
| CC Addresses | Checks the CC addresses on the email | |
| CC Names | Checks the CC names of the email | |
| Email Headers | Checks the headers of the email | |
| From Address | Checks the from address of the email | |
| From Header | Checks the From header on the email | |
| From Name | Checks the from name of the email | |
| Reply-To Addresses | Checks the Reply-To addresses of the email | |
| Reply-To Names | Checks the Reply-To name(s) of the email | |
| Return Path | Checks the Return-Path address of the email | |
| To Addresses | Checks the To addresses of the email header | |
| To Names | Checks the To name(s) of the email header | |
| Message | Email Content | Checks the content of the email body for sensitive information |
| Message Body | Checks the content of the email body | |
| Message Body Size | Checks the size of the email message body | |
| Subject Line | Checks the subject line of the email | |
| Region | Geographic Region | Checks if the geographic region of the connection matches the specific criteria |
| Region Risk Level | Checks the risk level of a region | |
| Source | Email Platform | Checks the email platform associated with the connection |
| Email Platform Type | Checks the type of the email platform | |
| IP Address | Checks the IP address of the connection, supporting CIDR notation | |
| Time | Day of Week Sent | Checks the day of the week an email was sent |
| Time of Day Sent | Checks the time of day an email was sent |
| OPERATOR | DEFINITION |
| Are greater than | Triggers when the field or input is greater than the given value |
| Are greater than or equal to | Triggers when the field or input is greather than or equal to the given value |
| Are less than | Triggers when the field or input is less than the given value |
| Are less than or equal to | Triggers when the field or input is less than or equal to the given value |
| Contain | Checks if the field or input does not include the given text or value |
| Contains | Checks if the field or input does not include the given text or value |
| Contain any of | Triggers when the field contains any of the comma-separated values (use \, for literal commas) |
| Contains any of | Triggers when the field contains any of the comma-separated values (use \, for literal commas) |
| Detect | Triggers when the specified element, keyword, or value is found |
| Detects | Triggers when the specified element, keyword, or value is found |
| Do not contain | Checks if the field or input does not include the given text or value |
| Do not contain any of | Triggers when the field does not equal any of the comma-separated values (use \, for literal commas) |
| Do not detect | Triggers when the specified element, keyword, or value is not found |
| Do not equal | Triggers when the field or input is not equal to the given value |
| Do not equal any of | Triggers when the field does not equal any of the comma-separated values (use \, for literal commas) |
| Do not match | Triggers when the field or input does not match the specified pattern or value |
| Does not contain | Checks if the field or input does not include the given text or value |
| Does not contain any of | Triggers when the field does not equal any of the comma-separated values (use \, for literal commas) |
| Does not detect | Triggers when the specified element, keyword, or value is not found |
| Does not equal | Triggers when the field or input is not equal to the given value |
| Does not equal any of | Triggers when the field does not equal any of the comma-separated values (use \, for literal commas) |
| Does not match | Triggers when the field or input does not match the specified pattern or value |
| Equal | Triggers when the field or input is exactly equal to the given value |
| Equals | Triggers when the field or input is exactly equal to the given value |
| Equal any of | Triggers when the field equals any of the comma-separated values (use \, for literal commas) |
| Equals any of | Triggers when the field equals any of the comma-separated values (use \, for literal commas) |
| Is greater than | Triggers when the field or input is greater than the given value |
| Is greater than or equal to | Triggers when the field or input is greather than or equal to the given value |
| Is less than | Triggers when the field or input is less than the given value |
| Is less than or equal to | Triggers when the field or input is less than or equal to the given value |
| OPERATOR INPUT | DEFINITION |
| ____ GB | Size in Gigabytes |
| ____ KB | Size in Kilobytes |
| ____ MB | Size in Megabytes |
| ____ TB | Size in Terabytes |
| Amazon SES | Email platform |
| Archive | Silence location: Put in recipient's "Archive" folder |
| Bank Account Number | Detects US routing numbers, IBAN, and bank account numbers |
| Bounce | Decision action to permanently bounce the message |
| Bundle | Trust location: send the message to the Bundled folder if the mailbox has Shield Pro enabled |
| Bypass | Decision action to bypass Shield filtering |
| Campaign Monitor | Email platform |
| Campaigner | Email platform |
| Constant Contact | Email platform |
| Country, Continent, or Region | Geographic region type |
| Credit Card Number | Detects credit card numbers for major card types (Visa, MasterCard, American Express, etc.) |
| CRM | Email platform type |
| Date of Birth | Detects dates of birth with contextual keywords in various formats |
| Defer | Decision action to defer the message |
| Deliver | Decision action to deliver the message |
| Deliver to Inbox | Override the delivery action and deliver the email to the Inbox |
| Discard | Decision action to permanently discard the message |
| Elastic Email | Email platform |
| Email provider | Email platform type |
| ExactTarget | Email platform |
| Financial Information | Detects common financial information like credit cards, bank accounts, and tax IDs |
| Free email provider | Email platform type |
| Friday | Day of the week |
| Gainsight | Email platform |
| Gmail | Email platform |
| Google Workspace Email | Email platform |
| HH:MM AM/PM | 12-hour time format with AM or PM required |
| High | Risk level, sends the message to Shield Jail |
| Hold | Decision action: keep the message for further review rather than delivering |
| Hubspot | Email platform |
iCloud |
Email platform |
Inbox |
Trust location: Trusted for immediate delivery to the inbox |
InfusionSoft |
Email platform |
Jail |
Silence location: Held in Shield's jail |
Junk |
Silence location: Put in recipient's "Junk" folder |
Low |
Risk level, sends the message to the Inbox for trusted senders or to the Junk Email folder for new senders |
Mailchimp |
Email platform |
Mailgun |
Email platform |
Mandrill (Mailchimp) |
Email platform |
Marketing |
Email platform type |
Marketo |
Email platform |
MFA Code |
Detects emails with MFA codes |
Microsoft 365 Email |
Email platform |
Moderate |
Risk level, sends the message to the Junk folder regardless of the sender's trust decision |
Monday |
Day of the week |
None |
Decision action: Delivered, silenced, or held for further review |
None |
Risk level, sends the message to the Inbox regardless of the sender's trust decision |
Number |
Attachment count number |
| One-time Password/MFA Code | Detects emails with one-time passwords (OTP/MFA/TFA) codes |
Outlook.com |
Email platform |
| Passport Number | Detects passport numbers for US, UK, EU, Canada, and Australia |
| Password Reset | Detects emails related to password reset requests |
| Personal Identifiable Information (PII) | Detects common PII patterns including SSN, credit cards, phone numbers, and more |
| Phone Number | Detects US and International phone numbers in various formats |
| Postmark | Email platform |
| Promotional Content | Detects common marketing and promotional language patterns |
| Protected Health Information (PHI) | Detects common PHI keywords and patterns in text |
| Regex Pattern | The regular expression pattern to match or not match on |
| Relay | Decision action to relay the message to its next destination |
| Reply to email | Send an automatic reply to the sender. Applies to user mailboxes only; skips groups and jailed messages. |
| Review | Decision action that requires a trust decision for the sender |
| Robly | Email platform |
| SalesForce | Email platform |
| Salesy Content | Detects aggressive sales language and high-pressure tactics |
| Saturday | Day of the week |
| Sendgrid | Email platform |
| Social Security Number | Detects US Social Security Numbers in format XXX-XX-XXXX or XXXXXXXXX |
| SparkPost | Email platform |
| Sunday | Day of the week |
| Tax ID / EIN | Detects US Tax Identification Numbers including EIN and ITIN formats |
| Thursday | Day of the week |
| Transactional | Email platform type |
| Trash | Silence location: Put in recipient's "Trash" folder |
| Tuesday | Day of the week |
| Unknown | Email platform type |
| US Driver's License | Detects US driver's license numbers in various state formats |
| Value | The value of the operator input |
| Wednesday | Day of the week |
| Yahoo | Email platform |
Workflow Actions
Inbound
| SECTION | ACTION | DEFINITION |
| Compliance | Journal to archive | Journal the email to an archive |
| Delivery | Bounce email | Return the email to the sender |
| Discard email | Discard the email | |
| Send copy to recipient | Send a copy of the email to a specified recipient | |
| Mailbox | Mark as read | Mark the email as read in the mailbox |
| Move to a folder | Deliver or move the email to a specific folder | |
| Security | Lock with Lockbox |
Protect the email content with Lockbox Note: Only runs for emails which are sent to Shield Pro users. |
| Run email decision | Decide again what the risk level, desirability, and action should be on the email | |
| Set risk level | Set the risk level of the email | |
| Trust Network | Silence the sender | Update the trust network to silence the sender |
| Trust new sender | Update the trust network to trust the sender | |
| Trust the domain | Update the trust network to trust the entire sender domain | |
| Silence the domain | Update the trust network to silence the entire sender domain | |
| Workflow | Trigger workflow | Triggers another workflow |
Outbound
| SECTION | ACTION | DEFINITION |
| Compliance | Journal to archive | Journal the email to an archive |
| Delivery | Bounce email | Return the email to the sender |
| Discard email | Discard the email | |
| Hold email | Hold email for review | |
| Send copy to recipient | Send a copy of the email to a specified recipient | |
| Security | Deliver email securely | Deliver the email securely using TLS with a fallback to Bracket. If the user isn't licensed for Bracket, the message will be held for review. This can only be applied to outbound workflows. |
| Deliver email with Bracket |
Deliver the email using Bracket. If the user is not licensed for Bracket, the message will be held for review. This can only be applied to outbound workflows. Note: Only runs for emails which are sent by Bracket users. |
|
| Run email decision | Decide again what the risk level, desirability, and action should be on the email | |
| Set risk level | Set the risk level of the email | |
| Workflow | Trigger workflow | Triggers another workflow |
| ACTION INPUT | DEFINITION |
| None | Decision action: Delivered, silenced, or held for further review |
| Low | Decision action: Sent to the junk folder if the sender is not trusted |
| Moderate | Decision action: Sent to the junk folder even if the sender is trusted |
| High | Decision action: Held in Shield's Jail |
| Archive | Silence location: Put in recipient's "Archive" folder |
| Jail | Silence location: Held in Shield's jail |
| Junk | Silence location: Put in recipient's "Junk" folder |
| Trash | Silence location: Put in recipient's "Trash" folder |
| Bundle | Trust location: Trusted for delivery to the "Bundled" folder |
| Inbox | Trust location: Trusted for immediate delivery to the inbox |
| Message | If the Bounce email action is chosen, a customized message can be added to the Bounce message |
| Bundled | Move action: Move to recipient's "Bundled" folder |
| Inbox | Move action: Move to recipient's Inbox |
| Archive | Move action: Move to recipient's "Archive" folder |
| Jail | Move action: Move to Jail |
| Junk | Move action: Move to recipient's "Junk" folder |
| Trash | Move action: Move to recipient's "Trash" folder |
| Email Address | Send copy to recipient email address |
| Journal Archive Address | Email address provided by the archive journaling service |
Updated