investigating-phishing-email-incident

Investigates phishing email incidents from the initial user report through header analysis, URL/attachment detonation, impacted-user identification, and containment actions using SOC tools such as Splunk, Microsoft Defender, and sandbox analysis platforms. Use when a reported phishing email requires a full incident investigation to determine scope and impact.