The Fine Print

import re
from typing import List
from pydantic import BaseModel, Field
from langchain_openai import ChatOpenAI
class PhishingAnalysis(BaseModel):
    is_phishing: bool = Field(description="True if email is malicious phishing attempt")
    confidence: float = Field(description="Confidence score 0.0 to 1.0")
    suspicious_indicators: List[str] = Field(description="List of detected anomalies")
    action_item: str = Field(description="Action to take, e.g., PURGE_MAILBOX, WHITE_LIST, NO_ACTION")
def analyze_phishing_email(headers: str, body: str) -> PhishingAnalysis:
    llm = ChatOpenAI(model="gpt-4o", temperature=0)
    structured_llm = llm.with_structured_output(PhishingAnalysis)
    urls = re.findall(r'https?://[^\s<>"]+', body)
    prompt = f"""
Analyze the following email for phishing indicators:
HEADERS:
{headers}
BODY:
{body}
EXTRACTED URLS:
{urls}
Evaluate domain spoofing, urgency indicators, mismatch between link text and href destination, and overall intent.
"""
    return structured_llm.invoke(prompt)
if __name__ == "__main__":
    sample_headers = "From: IT Support <support@secure-update-login-portal.com>\nTo: victim@company.com\nSubject: URGENT: Password Expired"
    sample_body = "Your corporate password expires today. Click here to retain access: http://secure-update-login-portal.com/login"
    res = analyze_phishing_email(sample_headers, sample_body)
    print(f"Is Phishing: {res.is_phishing}")
    print(f"Action Item: {res.action_item}")
    print(f"Indicators: {res.suspicious_indicators}")