Claim ownership in the SIEM to prevent duplicate work.

Who? What? When? Where? Check user, asset, time, and location.

Has this user/asset triggered similar alerts before?

True Positive: Escalate. False Positive: Document & Close.

Write a clear summary in the ticket. Tag related IOCs.

• Confirmed malware execution
• Active data exfiltration
• Compromised credentials
• Lateral movement detected
• Ransomware indicators

1. Update ticket with all findings
2. Assign to Tier 2 queue
3. Slack/Page the on-call analyst
4. Brief them verbally if critical

Sender address, subject, URLs, attachments, headers.

Use VirusTotal, URLScan.io, Any.Run. Check for credential harvesting.

Sandbox any files. Look for macros, executables, or encoded payloads.

Did anyone else receive this? Did anyone click?

Block sender/domain. Delete from all mailboxes. Reset passwords if needed.

Use EDR to network-isolate the machine immediately.

Capture memory dump, disk image, or relevant logs before remediation.

File hashes, C2 IPs, registry keys, scheduled tasks.

Search SIEM for IOCs across all endpoints.

Clean/reimage machine. Restore from backup. Monitor for reinfection.