Conversation
We've noticed some concerning activity and would like the SOC team to investigate urgently.
Subject: Ransomware behaviour alert on WS-LAP-011 — please investigate
Please provide an initial assessment as soon as possible. Our IT team is standing by to assist with any containment actions needed.
We've applied the policy change you requested. It will take effect within 15 minutes across all monitored endpoints. Please let us know if you see any issues.
The affected user has confirmed they changed their password. Can you verify MFA is active?
I've updated the DLP policy as requested. The HR shared drive is now excluded from the external transfer monitoring rule, but internal audit logging remains active.
Thanks. Could you also check if any other accounts were affected?