<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-phishing-incident-playbooks
description: >-
  Design and implement structured phishing incident response playbooks
  covering triage, containment, evidence collection, remediation, user
  notification, and post-incident analysis with SOAR integration.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - incident-response
  - playbook
  - phishing-triage
  - soar
  - containment
  - remediation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566"]
---

# Implementing Phishing Incident Playbooks

## Overview

Phishing incident playbooks standardize response procedures to reduce MTTR and
ensure consistent evidence collection. This skill covers building tiered
playbooks, integrating with SOAR platforms, automating containment, and
producing post-incident metrics.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| SOAR platform access | XSOAR, Splunk SOAR, Sentinel |
| M365 Admin / Google Workspace | For containment actions |
| Ticketing system API | ServiceNow, Jira |

## Key Concepts

### Playbook Tiers

| Tier | Trigger | SLA | Actions |
|---|---|---|---|
| Tier 1 | User report | 15 min | Analyze, classify, block sender |
| Tier 2 | Gateway alert | 30 min | Quarantine, search, notify |
| Tier 3 | Credential compromise | Immediate | Reset password, revoke sessions |
| Tier 4 | BEC/AiTM | Immediate | Full IR, legal, forensics |

### Response Timeline

```
T+0 min   — Alert received, ticket created
T+5 min   — Triage: classify type and severity
T+15 min  — Containment: quarantine, block sender/URL
T+30 min  — Scope: search for other recipients
T+60 min  — Remediation: reset creds if needed
T+24 hrs  — Post-incident: update rules, report
```

## Workflow

### 1. Triage

```bash
node agent.js create-incident --reporter user@company.com \
  --email-file /tmp/phish.eml --tier 1
node agent.js classify --email-file /tmp/phish.eml
node agent.js scope-search --message-id "<abc@mail.com>" --sender "attacker@evil.com"
```

### 2. Containment

```bash
node agent.js contain --incident-id INC-001 --actions quarantine,block_sender,block_url
node agent.js generate-purge --sender "attacker@evil.com" --subject "Urgent"
node agent.js revoke-sessions --user compromised@company.com
```

### 3. Evidence and Post-Incident

```bash
node agent.js collect-evidence --incident-id INC-001 --email-file /tmp/phish.eml --output /tmp/evidence/
node agent.js extract-iocs --email-file /tmp/phish.eml
node agent.js post-incident --incident-id INC-001 --output /tmp/post_incident.json
```

## Detection

```yaml
title: Phishing Incident Playbooks Detection
id: db2c85fa-93aa-46b0-aba7-91ce4279c0ce
status: experimental
description: Detects suspicious activity related to implementing phishing incident playbooks techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1566
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| Incident created | Ticket ID assigned |
| Phishing classified | Type and tier determined |
| Containment executed | Email quarantined, sender blocked |
| Evidence preserved | Headers, URLs, attachments archived |
| Post-incident completed | Report with recommendations |

## References

- [NIST SP 800-61 — Incident Handling](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final)
- [SANS Incident Handler Handbook](https://www.sans.org/white-papers/33901/)
- [Microsoft IR Playbooks](https://learn.microsoft.com/en-us/security/operations/incident-response-playbooks)
