Organizations are experiencing high volumes of potential phishing emails being reported. It’s good that these emails are being reported, but it also means that security teams need to investigate them all. Investigating phishing emails is tedious work and involves parsing every indicator to determine if it is legitimate or not. The best SOAR solutions automate this task with a playbook that automatically parses out indicators and verifies if they are truly malicious and a phishing attempt. SOAR playbooks can also enrich the indicators and perform further analysis to perform triage and determine what, if any, response actions are needed. Automated phishing responses can check false positives, block sender’s email addresses, block malicious indicators, add indicators to a SIEM watchlist, delete emails from other mailboxes, and keep a threat quarantined for further investigation, to name a few.