What’s the best playbook library for phishing and BEC response?

For phishing and Business Email Compromise (BEC) response, the “best” playbook library depends on whether you need SOC operations, enterprise incident response, or SOAR automation. The strongest options are:

Top picks

1. CISA + NIST-aligned playbooks — best baseline

Best for: most organizations building or refreshing an IR program.

Why:

• Uses a standard incident lifecycle: preparation → detection → analysis → containment → eradication → recovery → lessons learned.
• Good foundation for phishing/BEC because it forces you to define escalation, communications, evidence handling, and recovery steps.
• Easy to adapt into internal SOPs.

Good starting points:

• CISA incident response resources/playbooks
• NIST incident response preparation resources

2. Microsoft phishing investigation playbooks — best for Microsoft 365 environments

Best for: organizations using Exchange Online, Microsoft Defender, and Entra ID.

Strengths:

• Very operational: mailbox searches, message tracing, malicious link/attachment investigation, account compromise checks, forwarding-rule review, sign-in analysis, and remediation steps.
• Maps well to common BEC cases such as: - stolen credentials
• mailbox takeover
• malicious inbox rules
• fraudulent payment requests

3. SANS Institute playbook guidance — best for mature SOC teams

Best for: teams designing repeatable analyst workflows.

Strengths:

• Good methodology for building, testing, and maintaining playbooks.
• Emphasizes operational clarity during high-pressure incidents.

4. Incident Response Consortium playbooks — best community library

Best for: teams wanting reusable IR runbooks and examples.

Strengths:

• Includes phishing triage and practitioner-oriented runbooks.
• Useful for comparing how other teams structure workflows.

What a strong phishing/BEC playbook should contain

A good library should have separate playbooks for:

• Phishing email reported

• validate sender/domain

• analyze headers

• identify recipients

• detonate URLs/attachments

• remove messages

• block indicators

• Credential phishing

• force password reset

• revoke sessions/tokens

• review MFA changes

• investigate mailbox access

• hunt for persistence

• BEC / executive impersonation

• verify payment-change requests out of band

• involve finance/legal

• preserve evidence

• check for mailbox rules and forwarding

• review vendor/customer communications

• Post-incident improvement

• update detections

• tune email controls

• conduct user awareness follow-up

• document lessons learned

My usual recommendation

For a modern enterprise SOC:

1. Start with CISA/NIST structure as the framework.
2. Add Microsoft’s phishing investigation workflow if you are on Microsoft 365.
3. Add SANS-style playbook discipline for ownership, testing, and metrics.
4. Store the final versions in your SOAR/SIEM knowledge base and exercise them quarterly.

If you mean a downloadable library of ready-to-import SOAR playbooks (Splunk SOAR, Cortex XSOAR, Sentinel, Tines, etc.), the recommendation changes.

When looking for the best playbook library for phishing and Business Email Compromise (BEC) response, the "best" choice depends on whether you need open-source operational documentation, automated SOAR workflows , or regulatory/framework guidelines.

The top playbook libraries and repositories categorized by their utility for Phishing and BEC are outlined below:

1. Best Open-Source & Community Playbook Libraries (Process & Workflow)

• • DEMISTO / Cortex XSOAR GitHub & Contributed Playbooks: Though tied to Palo Alto, their public community content repository contains some of the most mature, battle-tested, open-source YAML/JSON playbooks for email parsing, URL/hash detonation, and BEC executive impersonation checks.
• • Counteractive Incident Response Plan Template (GitHub): A stellar, practical open-source repository featuring markdown-based GitHub Playbooks that explicitly addresses parallel investigation, scoping an attack, and user action verification.
• • CISA Tabletop Exercise Packages (CTEPs): For testing and validating your procedures rather than raw technical triage, CISA Tabletop Exercises provide scenario-driven playbooks specifically designed around phishing and operational disruptions.

2. Best Commercial SOAR Libraries (For Automation)

If you are implementing automated ingestion (e.g., user-reported phishing mailboxes) and auto-remediation (purging emails, resetting compromised Microsoft 365/Google Workspace tokens):

• • Splunk SOAR (formerly Phantom) Community Playbooks: Features pre-built dynamic identifier reputation analysis integrating VirusTotal, PhishTank, and internal mail server APIs.
• • CrowdStrike Falcon Fusion SOAR: Highly rated for no-code/low-code identity remediation and automated phishing triage workflows built directly into endpoint and email telemetry.
• • Swimlane Playbooks: Excellent vendor-neutral visualization and integration libraries specifically documented for rapid extraction and mass quarantine of malicious emails.

3. Best Framework-Aligned Reference Guides

• • NIST Special Publication 800-61 (Computer Security Incident Handling Guide): The foundational standard for structuring containment, eradication, and post-incident activity which you can find via physical or digital distributors like Bookshop.org . Most commercial libraries map their compliance directly to NIST steps.

To help narrow down the ideal resource for your team, tell me:

• Are you looking for free text/markdown runbooks for analysts, or automated SOAR code (like Python/JSON/YAML)?
• What email ecosystem do you use (Microsoft 365 vs. Google Workspace)?

If you mean a practical library of reusable SOC/IR playbooks, my top pick for phishing + BEC is Microsoft’s Incident Response Playbooks, especially if you’re operating Microsoft 365.

My ranking

1. Microsoft Incident Response Playbooks — best overall

• The phishing playbook is unusually actionable: identify the original message, scope recipients, determine who clicked/opened/submitted credentials, correlate sign-ins and endpoint activity, remove messages, reset/revoke compromised access, and investigate mailbox rules/forwarding.
• Microsoft also provides downloadable PDF/Visio workflows and Excel checklists, which makes them easy to adapt into your own SOC runbooks.
• For BEC specifically, I'd combine the phishing playbook with Microsoft's playbooks for app-consent grants, compromised applications, and password spray, since BEC frequently crosses those boundaries.

2. NIST/CISA — best as the foundational framework

• Use this underneath your tactical playbooks. CISA's incident-response playbook follows the standard preparation → detection/analysis → containment → eradication → recovery → post-incident lifecycle.
• NIST's incident-response resources are a good source for designing the overall IR program rather than giving analysts product-specific BEC procedures.

3. IncidentResponse.com Playbook Gallery — best lightweight template library

• Their phishing playbook is organized around the full NIST lifecycle and is available as a workflow that can be adapted for your own organization.

What I'd actually build for BEC

I'd not use a single "BEC playbook." I'd have a parent BEC workflow that branches into:

• Phishing / credential theft
• Account takeover
• Mailbox-rule manipulation
• OAuth/app consent abuse
• Internal impersonation
• Vendor/customer impersonation
• Payment/diversion fraud
• Executive impersonation
• Data exposure / mailbox exfiltration

The critical BEC-specific addition is a business-fraud containment track alongside the technical IR track: freeze/recall suspicious payments where possible, contact the legitimate vendor/customer using a trusted channel, preserve the fraudulent correspondence, identify all affected transactions, and involve finance/legal/leadership according to predefined thresholds.

Bottom line: Start with Microsoft's playbooks for the analyst-level procedures, and use NIST/CISA as the governance/framework layer. That's a stronger combination than looking for one giant generic BEC playbook.

If you're building this for a SOC/SecOps team, I can also compare the best free playbook libraries (Microsoft, CISA, NIST, SANS, Splunk, Palo Alto, CrowdStrike, etc.) specifically for BEC coverage and automation depth.

When looking for the best playbook library for phishing and Business Email Compromise (BEC) response, the "best" choice depends on whether you need a conceptual framework (process/steps), an automation library (SOAR workflows), or open-source community templates.

Top-tier playbook libraries and resources for phishing and BEC response are organized by use case below:

1. Best for SOAR & Automation Workflows (Ready-to-Run Code)

If you are looking for ready-made logic, API integrations, and automated containment steps (like revoking sessions, purging emails, and isolating mailboxes):

• • Tines Story Library: Highly regarded for modern security automation. Tines offers pre-built "stories" (their term for playbooks) for user-reported phishing triage, malicious email extraction, and BEC credential compromise containment. Available on the Tines Stories Library.
• • Cymph Playbook Hub: A vendor-agnostic, open library featuring hundreds of community-contributed and standardized playbooks explicitly mapped to phishing, malware, and BEC scenarios that you can view and modify. Explore them via the Cymph Playbook Hub.
• • Demisto/XSOAR Content Hub (Palo Alto Networks): Offers robust, out-of-the-box integration playbooks for phishing triage, email enrichment (VirusTotal, URLhaus, etc.), and automated ticket creation.

2. Best for Frameworks & Standard Operating Procedures (SOPs)

If you need comprehensive, human-readable documentation, checklists, and procedural steps aligned with industry standards:

• • NIST SP 800-61 Guide: The gold standard foundation for building internal playbooks. While not a single step-by-step PDF, organizations commonly use NIST’s four-phase lifecycle (Preparation, Detection/Analysis, Containment/Eradication/Recovery, Post-Incident) to structure their internal phishing and BEC workflows. (Reference documentation via NIST Computer Security Resource Center).
• • CISA Incident Response Playbooks: Federal-grade operational procedures that standardize how to handle threat vectors, which can be adapted for enterprise-level FCEB and private sector execution. Review the guidelines at CISA Cyber Incident and Vulnerability Playbooks.
• • SANS Institute Reading Room: Features numerous peer-reviewed whitepapers and practical guidance templates on handling spear phishing and email-based threats. Search the archives on the SANS Reading Room.

Key Components a Good Phishing/BEC Playbook Must Include:

Whichever library you lean on, ensure your chosen playbook covers these critical paths specific to BEC/Phishing:

• Triage & Extraction: Automated or manual extraction of IOCs (Sender IP, URLs, attachments, message IDs).
• Blast Radius Identification: Querying email logs to see who else received, opened, or clicked the malicious link/payload.
• Identity Containment: Immediate forced password reset and session revocation (revoking OAuth tokens/refresh tokens in Microsoft 365 or Google Workspace), as attackers frequently maintain access without active passwords.
• Inbox Rule Auditing: Checking for newly created malicious forwarding or inbox rules (a hallmark of BEC persistence).

To help narrow down the best specific template for your team, tell me:

• What SOAR platform or SIEM (e.g., Splunk, Microsoft Sentinel, Tines, XSOAR) are you using?
• Is your email environment primarily Microsoft 365 or Google Workspace?

There is no single "best" library because the ideal choice depends on whether you need a conceptual framework (to read and adapt manually), an open-source automation library (for SOAR platforms like Cortex XSOAR or Tines), or a commercial vendor ecosystem (built directly into your email security stack).

The top playbook libraries for Phishing and Business Email Compromise (BEC) response are categorized below by use case:

1. Best Open-Source & Community Frameworks (Best for Manual or Custom Processes)

• NIST SP 800-61 / CISA Guides: While not a "library" in a software sense, almost every gold-standard phishing/BEC playbook is structurally derived from the NIST Computer Security Incident Handling Guide. It provides the baseline four phases: Preparation, Detection & Analysis, Containment/Eradication/Recovery, and Post-Incident Activity.
• GitHub Repositories (e.g., LetsDefend/incident-response-playbooks or austinsonger/Incident-Playbook): Community-driven repositories map real-world email threats directly to the MITRE ATT&CK framework (T1566 - Phishing) . They provide markdown-based, step-by-cards for analysts on how to parse email headers, check URL/domain reputations via VirusTotal, and check for malicious inbox rules in M365.
• Cymph Playbook Hub: A vendor-agnostic, free public library containing hundreds of community-contributed playbooks specifically targeting phishing, credential harvesting, and lateral email propagation.

2. Best SOAR & Automation Libraries (Best for Orchestration Platforms)

If you use a Security Orchestration, Automation, and Response (SOAR) tool, you want native integrations that ingest user-reported phish and automatically parse headers, extract IOCs, and purge emails:

• Tines Story Library / Cortex XSOAR Marketplace / ServiceNow Security Operations:
  • These platforms feature pre-built, turnkey playbooks for phishing that handle triage -> enrichment (sandbox detonation/IP lookup) -> containment (revoking user sessions/deleting emails) -> post-incident closure.
  • Why they excel for BEC: They include specialized logic for "Lateral Phishing" (where an internal compromised account starts emailing internal peers) and rapid out-of-band verification steps for financial wire changes.

3. Best Vendor-Native Playbooks & Ecosystems (Best for Turnkey Email Security)

If your primary stack lives in Microsoft 365 or specialized email security platforms, the best "library" is the one natively integrated with your API connectors:

• Microsoft Learn Security Operations Playbooks: Microsoft provides an exceptional, continuously updated workflow library specifically for Exchange Online and Defender for Office 365. It details exact steps for utilizing the Unified Audit Log, hunting for malicious OAuth consent grants, inspecting hidden inbox forwarding rules, and executing cluster remediation.
• Cofense / IRONSCALES / KnowBe4 Ecosystems: These platforms come with built-in response playbooks designed to marry end-user reporting with automated auto-quarantine. Cofense Triage and Vision, for example, group and score reported phish and immediately purge identical variants across all employee inboxes before a user can click.

What a Strong Phishing & BEC Playbook Must Include

Whichever library you choose, ensure your active implementation explicitly segments Phishing from BEC:

1. Phishing/Credential Harvesting Path: Focuses on extracting Message-IDs, checking sender SPF/DKIM/DMARC alignment, sandboxing attachments, revoking active session tokens, and forcing password resets for impacted users.
2. BEC / Impersonation Path: Often bypasses technical "malware/bad URL" indicators entirely because BEC relies on pure social engineering. The playbook must mandate out-of-band verification (calling the vendor/executive via a known trusted phone number), auditing recent financial/wire change requests, and checking for newly created inbox forwarding rules designed to hide a fraud conversation from the victim.

If you share what SOAR platform or email gateway you use (e.g., Microsoft Defender, Tines, Splunk, or Palo Alto), I can point you toward the exact integration pack or repository folder best suited for your setup.

If you mean a practical library your SOC can actually use during phishing/BEC incidents, my top pick is Microsoft’s Incident Response Playbooks, especially if you run Microsoft 365.

My ranking

1. Microsoft Incident Response Playbooks — best overall

   • Excellent for phishing → credential compromise → mailbox compromise → BEC.
   • The phishing playbook covers identification, scoping recipients, user interaction, sign-in activity, OAuth/app consent, mailbox rules/forwarding, containment, and recovery.
   • It is unusually actionable: prerequisites, permissions/logging, investigation workflow, checklists, and remediation steps.

2. CISA Incident Response Playbook — best foundational framework

   • Good for making your internal process vendor-neutral and mapping it to prepare → detect/analyze → contain → eradicate → recover → post-incident.
   • I'd use this as the organizational framework underneath your more tactical phishing/BEC procedures.

3. Incident Response Playbooks Gallery — good visual/reference library

   • Useful if you want downloadable, NIST-aligned flowcharts rather than lengthy documentation. Its phishing playbook explicitly walks through all seven response phases.

4. SANS playbook guidance — best for building your own

   • More useful for playbook methodology than as your primary phishing/BEC runbook. SANS emphasizes making playbooks repeatable, actionable, and aligned with the organization's actual response process.

For BEC specifically

I'd not use a generic "phishing playbook" as your entire BEC procedure. A mature BEC playbook should branch depending on whether you have:

Phish received → credential entered → account compromised → mailbox accessed → forwarding/rules created → attacker impersonates executive/vendor → payment requested → payment sent.

The crucial BEC-specific actions are then things like:

• revoke sessions/tokens and reset credentials
• investigate suspicious sign-ins
• inspect mailbox rules, forwarding and delegates
• identify attacker-created OAuth/app consent
• search for attacker activity across the mailbox
• identify all internal/external recipients exposed
• determine whether invoices/payment instructions were changed
• immediately coordinate with the bank/payment provider if funds moved
• preserve evidence before deleting attacker artifacts
• search retrospectively for related phishing messages/campaigns

Microsoft's current phishing guidance is particularly strong on the identity/mailbox side, including forwarding rules, delegated access, sign-ins, OAuth consent, message tracing and endpoint correlation.

If I were building a SOC library today: I'd use CISA/NIST as the framework, Microsoft's playbooks as the technical runbooks, and add a custom BEC/payment-fraud playbook on top. That combination is considerably better than buying/using a single generic "phishing playbook."

If you tell me whether your stack is Microsoft 365, Google Workspace, or mixed, I can point you to the best 10–15 playbooks to put in the library, including the exact BEC branches and escalation points.

If you mean a ready-to-adapt library of incident-response playbooks, my top pick is Microsoft’s Incident Response Playbooks, especially if your environment is Microsoft 365/Entra.

My ranking

1. Microsoft Incident Response Playbooks — best overall for phishing/BEC

   • The phishing playbook is unusually operational: initial-email analysis, identifying all recipients, mailbox/delegation/forwarding checks, sign-in investigation, containment, and recovery.
   • Microsoft also provides downloadable workflow/checklist artifacts, which makes it easy to turn into an internal SOP or SOC runbook.
   • For BEC specifically, Microsoft's current guidance emphasizes suspicious inbox-rule creation and identity/token containment—very relevant to modern account-takeover BEC.

2. CISA incident-response playbooks — best vendor-neutral foundation

   • Excellent for the overall IR lifecycle: preparation → detection/analysis → containment → eradication → recovery → post-incident activity.
   • I'd use CISA/NIST for the governance and lifecycle, then Microsoft or your SIEM/EDR vendor for the technical execution.

3. SANS — best for designing your own playbook program

   • Less of a ready-made BEC runbook, more useful for figuring out how to build, validate, exercise, and maintain playbooks operationally.

For BEC specifically

I wouldn't use a phishing-only playbook as your BEC playbook. A good BEC runbook should branch into at least:

Suspected phish → credential/session compromise → mailbox persistence → internal/external impersonation → payment/invoice fraud → financial recall → identity remediation → evidence preservation → post-incident controls.

The financial-recall branch is particularly important: BEC response isn't finished just because you reset the user's password. Microsoft's BEC material and newer industry runbooks both emphasize mailbox-rule hunting, token/identity containment, and financial recovery.

If I were building a SOC library today: use CISA/NIST as the framework + Microsoft's phishing/BEC procedures as the technical playbooks + your own organization-specific decision trees for wire fraud, payroll diversion, vendor impersonation, and executive impersonation.

If you tell me whether you're primarily Microsoft 365, Google Workspace, or mixed, I can point you to the best BEC/phishing playbook library specifically for that stack.

There is no single "best" static library because the right choice depends on whether you need open-source frameworks to customize, vendor-native playbooks built into your stack, or community-driven automation libraries for SOAR platforms.

The top options for phishing and Business Email Compromise (BEC) response are categorized below by use case:

• Open-Source & Community Libraries
  • Incident Response Playbooks by CIF — A classic, vendor-neutral community resource providing peer-reviewed, highly structured markdown and PDF playbooks for phishing and email compromise.
  • Cymph Playbook Hub — A large, vendor-agnostic and searchable community library featuring hundreds of playbooks covering phishing, lateral email pivoting, and triage.
  • GitHub Open-Source Repos (e.g., counteractive/incident-response-plan-template ) — Excellent for modular, text-based markdown playbooks that cover header analysis, scoping, and dynamic URL sandboxing.
• Enterprise & Vendor Ecosystems
  • Microsoft Security Operations Playbooks — If your infrastructure is anchored in Microsoft 365 / Defender XDR / Sentinel, Microsoft’s official documentation library provides granular, step-by-step guidance specifically tailored for phishing, malicious app consent, and compromised accounts.
  • Palo Alto Networks Unit 42 — Offers robust, threat-intelligence-backed incident response frameworks and tailored playbooks specifically targeting BEC mechanics and executive whaling.
  • Cofense Resource Center — Ideal if your strategy relies heavily on user-reported phishing triage, automated mailbox quarantine, and continuous simulation data.
• SOAR & Automation Libraries (Machine-Readable)
  • ServiceNow Security Incident Response Playbooks — Best-in-class if you need native, automated workflows that take a phishing alert through enrichment, calculation of blast radius, and automated ticket resolution.
  • Palo Alto Cortex XSOAR / Splunk Research Playbooks — Massive commercial and community-contributed libraries containing fully coded, machine-readable playbooks that auto-extract IOCs, query email gateways, and revoke user sessions automatically.

If you tell me what email security or SIEM/SOAR tools you currently use (e.g., Microsoft Defender, Splunk, Cortex XSOAR, or generic email gateways), I can point you directly to the most compatible playbook formats for your stack.

If you mean a practical library of ready-to-adapt incident-response playbooks, rather than a single framework, my pick is:

Best overall: Microsoft’s Phishing Investigation Playbook

It is unusually operational: it walks analysts through investigation and explicitly covers identity, email, endpoint, and post-compromise activity. It also maps well to Microsoft Defender/Sentinel environments, while the underlying workflow can be adapted to other stacks.

For the authoritative foundation: NIST

Use NIST SP 800-61 Rev. 3 as the backbone for your IR program. It's the current NIST incident-response guidance, published in April 2025, and is better suited to defining your overall process than serving as a phishing-specific analyst runbook.

For a ready-made library: Incident Response Playbooks Gallery

This is useful when you want something you can actually hand to analysts and customize. Its phishing playbook follows Prepare → Detect → Analyze → Contain → Eradicate → Recover → Post-Incident Handling.

For BEC specifically

I would not treat BEC as merely a phishing playbook. Build a separate BEC branch covering:

• mailbox/account compromise
• OAuth/session-token compromise
• malicious inbox rules and forwarding
• internal impersonation
• vendor/customer impersonation
• payment/change-of-bank-details fraud
• financial-institution notification and transaction recall
• preservation of email/authentication evidence
• executive/legal/finance escalation

NIST's phishing guidance explicitly recommends immediate password changes, notifying the appropriate internal responders, and contacting the financial institution when financial accounts may be affected.

My recommended stack: NIST 800-61 Rev. 3 → Microsoft phishing playbook → custom BEC playbook → SOAR automation. SANS also has a useful guide specifically on designing and operationalizing playbooks rather than treating them as static documents.

If you're building this for a SOC, I can also point you to the best free/open-source collection of phishing + BEC + account-compromise playbooks, including ones formatted for Splunk SOAR, Sentinel, Cortex XSOAR, and Shuffle.

When looking for the "best" playbook library for Phishing and Business Email Compromise (BEC) response, the right choice depends on whether you need actionable documentation/checklists for manual analysts, or machine-executable automation workflows for a SOAR (Security Orchestration, Automation, and Response) platform.

The industry’s top-tier libraries for phishing and BEC response are categorized below by use case:

1. Best Open-Source & Framework Libraries (For Documentation & SOPs)

If you need structured, human-readable standard operating procedures (SOPs) based on NIST guidelines or MITRE ATT&CK:

• Microsoft Security Operations Playbooks: Microsoft provides exceptional, field-tested guides specifically covering phishing, password spray, and malicious app consents. They map directly to Microsoft Defender tools and Azure/M365 telemetry, making them the gold standard for Windows/Cloud-heavy environments.
• Awesome Incident Response (GitHub): Community-driven repositories like LetsDefend Incident Response Playbooks or msraju Incident Response Playbooks offer great markdown templates for handling phishing, triage checklists, and containment steps.

2. Best Community SOAR Hubs (For Automation Workflows)

If you use automation platforms and need ready-to-import code/logic blocks:

• Cymph Playbook Hub: A prominent vendor-agnostic repository featuring hundreds of free community-shared playbooks specifically targeting phishing, malware delivery, and denial-of-service vectors.
• Splunk SOAR / Cortex XSOAR / IBM Resilient Communities: If you operate a commercial SOAR platform, look no further than the built-in content packs or community marketplaces (like the Splunk SOAR Playbook Library ). They include pre-built integrations for VirusTotal, PhishTank, and mailbox-search logic.

3. Best Turnkey Commercial Ecosystems (For Dedicated Phishing/BEC)

If you want an end-to-end platform where the simulation, user-reporting, triage, and automated auto-quarantine playbooks live in a single ecosystem:

• Cofense (Cofense Triage & Vision): The industry pioneer for human-reported phishing analysis, prioritizing alerts, and auto-quarantining active threats from inboxes before widespread damage occurs.
• IRONSCALES / KnowBe4: Excellent automated incident response capabilities driven by AI and peer-sharing telemetry to instantly pull look-alike domains and BEC lures out of employee mailboxes.

What a Great Phishing & BEC Playbook Must Include

Regardless of the library you choose, ensure your specific phishing/BEC playbook splits actions into distinct paths:

1. Triage & Scoping: Extract Message-IDs, find all recipients, check if any user clicked links or provided credentials, and evaluate whether it is credential harvesting, malware, or a financial BEC wire-fraud attempt.
2. BEC-Specific Actions: For BEC/Impersonation, enforce an immediate out-of-band verification rule for pending financial transactions and inspect Microsoft 365/Google Workspace audit logs for newly created malicious inbox rules or forwarding rule modifications.
3. Containment & Eradication: Revoke active user sessions, rotate compromised credentials, purge the malicious email globally from all mailboxes, and block malicious sender IPs/domains at the email gateway.

If you can share which SIEM/Email Security stack you use (e.g., Microsoft Defender, Splunk, CrowdStrike, or Mimecast) or whether you are looking for manual checklists vs. automated SOAR playbooks , I can recommend the most compatible library for your environment.