Skip to main content
Wazuh detects encryption-pattern file writes on three Windows file servers at a customer site, and Defender flags lateral SMB to two more. The MSP needs to contain the spread within minutes — at the switch, the firewall, and Entra ID — preserve evidence for the cyber-insurance investigation, restore the affected shares from clean backups, and have the customer’s executive team in a structured call within the hour. The support outcome is a contained incident with a clear recovery owner, preserved evidence, and an informed customer. Configure the agent to gather context, coordinate the incident team, and track decisions and follow-up; use the technical walkthrough for the operator-led response. Define these boundaries in the full support loop before delegating any containment action.

​
Systems involved

​
Technical playbook

1

Verify the detection in 60 seconds

Copilot pulls the Wazuh and Defender alerts onto one timeline. The encryption pattern matches a known family, the source IP traces to a single contractor laptop on the guest VLAN, and SMB traffic to three file servers is active right now.
2

Quarantine at the switch

SSH to the access switch the contractor laptop is on. Copilot identifies the port from the MAC table and stages a shutdown and a VLAN move into the quarantine VLAN. Approval prompt; you approve and execute.
3

Cut east-west at the firewall

Push deny rules at the FortiGate between the guest VLAN and the file server VLAN. Block SMB to all of 10.10.20.0/24 from anything outside the file server segment for the duration of the incident.
4

Disable suspect accounts

Through the Graph connector, disable the contractor’s account and the two service accounts seen in the lateral movement. Revoke all sessions and tokens. The action is logged with timestamps for the case file.
5

Snapshot the affected hosts

Through the vCenter connector, take a snapshot of each of the five affected VMs without rebooting them. The snapshots become the forensic image set for the investigators.
6

Identify clean restore points

Through the Datto connector, list backups for the five servers. Copilot highlights the last verified-good restore points before the encryption pattern began and proposes the restore order: domain controllers and DNS first, then file servers, then dependent services.
7

Open the IR record and brief the customer

Copilot opens the ServiceNow IRM record, attaches the alert evidence, the snapshot list, and the restore plan. Drafts a one-page executive briefing for the customer CEO and CIO: scope, containment status, restore plan, ETA, and the next update time.
8

Run the executive call

Open a shared Studio session with the customer’s executive team. Screen the timeline diagram, the containment status, and the restore plan. Recording on. The call ends with assigned actions and a 30-minute next-update commitment.
9

Restore and validate

Trigger the Datto restore in the agreed order. After each restore, run the validation procedure: services back, AD healthy, file shares mounting, no encrypted-pattern writes recurring.
10

Hand to forensics

Hand the case file and the snapshot images to the appointed DFIR firm through the ServiceNow record. Internal #sec-ir channel keeps a running log for the rest of the incident lifecycle.

​
Support outcome

  • The response owner can trace containment decisions to evidence and the actions actually performed.
  • Recovery checks and remaining risks are visible to the customer and the responsible engineers.
  • Unfinished restoration and post-incident work become assigned cases with the evidence needed to continue.

Procedures

Author Ransomware containment so the steps are pre-staged for the next time.

Shared sessions

Bring the customer’s exec team into a recorded session for the structured update.