Dealing with "Email reported by user as malware or phish"

We're working through automation of our Defender 365 incidents in Sentinel to try and reduce the operational load on our team.   One of the most common incidents we receive is "Email reported by us...