Describes a method for automatically investigating and responding to an email-based phishing incident.