# How do I build a phishing-report triage and response workflow?

**URL:** <https://community.tines.com/t/how-do-i-build-a-phishing-report-triage-and-response-workflow/129>\
**Category:** Tines 3B: Ask + Answer\
**Created:** [July 6, 2026, 8:39pm UTC](https://community.tines.com/t/how-do-i-build-a-phishing-report-triage-and-response-workflow/129 "2026-07-06T20:39:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sapling](https://dub1.discourse-cdn.com/tines/user_avatar/community.tines.com/sapling/32/36_2.png) [@sapling](https://community.tines.com/u/sapling)\
**Post date:** [July 6, 2026, 8:39pm UTC](https://community.tines.com/t/how-do-i-build-a-phishing-report-triage-and-response-workflow/129/1 "2026-07-06T20:39:45Z")

</div>

Reported phishing emails eat up a lot of my team’s time and I’d like to automate the first pass. How would I build a phishing report triage and response workflow in 3B? I’m curious what the typical steps look like, from receiving the report through to taking action. A sketch of the usual pattern would give me a solid starting point.

---

<div class="post-metadata">

**Author:** ![liam](https://dub1.discourse-cdn.com/tines/user_avatar/community.tines.com/liam/32/61_2.png) [@liam](https://community.tines.com/u/liam)\
**Post date:** [July 21, 2026, 3:29pm UTC](https://community.tines.com/t/how-do-i-build-a-phishing-report-triage-and-response-workflow/129/2 "2026-07-21T15:29:36Z")

</div>

There are examples in the Tines blog and examples gallery on phishing. However, one of the very best ways to start automating your team’s phishing process is to take your existing run book and use that as an input to 3B. We’ve found that to be a really effective way of building these out.

And that doesn’t just apply to phishing workflows. Try it with any of your other runbooks for things like vulnerability management, incident escalation, password resets, and account lockouts, etc.