Employees receive an email from an executive within the organization that summarizes a recent security breach and requests that employees verify their credentials through a provided link. Several…

Evaluating IDS alerts is not a primary first step for phishing because the email itself typically does not trigger IDS alerts until after a payload executes or a malicious outbound connection is established.

Communicating with employees and isolating affected assets is a containment action that belongs after the initial investigation confirms a threat - performing it first disrupts the investigation before scope is known.

Reviewing firewall and HIPS configurations to identify exploited vulnerabilities is a remediation-phase activity and is premature before the nature and delivery mechanism of the phishing attack are confirmed.

Reviewing mail server logs identifies all recipients of the suspicious email, and proxy logs reveal whether any employee clicked the provided link, directly establishing the scope and potential impact of the breach.

Examining the email header exposes spoofed or forged sender information to confirm it is not a legitimate executive email, and analyzing the embedded link inside an isolated sandbox environment safely identifies the malicious payload or credential-harvesting site.