tools/processes for analizing spear phishing smtp messages - incident response

I’ve detected multiple spear phishing attempts against my organization. We are forming a security/incident response process. Other than header information from the spear phishing smtp messages, are there others tools or online resources that can assist us in determining the legitimacy of these smtp messages or tracking their origin or ? Additionally, most of these emails have a link to a bogus site that installs a Trojan or bot in the background. If a user’s machine should become infected, what’s the best course of action for detecting the malware and discovering know research on the malware to determine its threat severity?