Threat Alert Policy

We recently had a user whose email account became compromised as a result of them clicking on a link and entering their credentials. We took the recommended steps. By the time we got to know about it...