Automated mitigation of electronic message based security threats

A method comprising:

• receiving, at a security decision point device disposed within a computational instance of a remote network management platform, a message by way of a managed network, wherein the message was obtained by a particular computing device disposed within the managed network, and wherein the computational instance is dedicated to serving the managed network;
• parsing, by the security decision point device, the message to identify observable indicators of one or more of the security threats, wherein the observable indicators include at least one of a network address, a hyperlink, or a representation of an attached file;
• remotely querying, by the security decision point device, a security threat database for the observable indicators;
• receiving, by the security decision point device and from the security threat database, an indication that the observable indicators are not associated with any security threats;
• and
• transmitting, by the security decision point device and to a security enforcement point device disposed within the managed network, a command to update a security policy applied to future messages received at the security enforcement point device and that have the observable indicators, such that the future messages having the observable indicators are classified as spam and not forwarded to the security decision point application.

An article of manufacture including a non-transitory computer-readable medium, having stored thereon program instructions that, upon execution by a security decision point device disposed within a computational instance of a remote network management platform, cause the security decision point device to perform operations comprising:

• receiving a message by way of a managed network, wherein the message was obtained by a particular computing device disposed within the managed network, and wherein the computational instance is dedicated to serving the managed network;
• parsing the message to identify observable indicators of one or more of the security threats, wherein the observable indicators include at least one of a network address, a hyperlink, or a representation of an attached file;
• remotely querying a security threat database for the observable indicators;
• receiving, from the security threat database, an indication that the observable indicators are not associated with any security threats;
• and
• transmitting, to a security enforcement point device disposed within the managed network, a command to update a security policy applied to future messages received at the security enforcement point device and that have the observable indicators, such that the future messages having the observable indicators are classified as spam and not forwarded to the security decision point application.