Knowledge Base

Find answers to common questions and learn more about our services

Clear

Logging gaps post-incident remediation plan

## Overview Post-breach, insurers and regulators ask **what you could not see**. Convert pain into **funded** logging backlog. ## Discovery pass Tabl...
incident-response-disaster-scenarios msp seed-library
Oct 14, 2024 Read more →

Restoration priority: AD versus email versus ERP

## Overview **Restore order** depends on **dependencies** and **blast radius**. Wrong order burns hours rebuilding twice. ## General pattern 1. **Net...
incident-response-disaster-scenarios msp seed-library
Oct 13, 2024 Read more →

Public relations holding statement placeholders

## Overview **Holding statements** buy time while facts solidify. Pre-fill **placeholders** in the IR folder—**legal** approves before use. ## Intern...
incident-response-disaster-scenarios msp seed-library
Oct 12, 2024 Read more →

Client executive briefing outline during IR

## Overview Executives need **status**, **business impact**, **next 24–48h decisions**, and **confidence**—not raw IOC lists. ## Slide structure (15...
incident-response-disaster-scenarios msp seed-library
Oct 11, 2024 Read more →

Law enforcement contact decision tree

## Overview **When to call law enforcement** depends on jurisdiction, sector, data types, and **ransom** dynamics—**legal counsel** approves contact f...
incident-response-disaster-scenarios msp seed-library
Oct 10, 2024 Read more →

Forensics preservation without tipping actors

## Overview **Stealth preservation** matters when **APT** may monitor email or RMM. Balance **legal** need for evidence vs **operational** secrecy. #...
incident-response-disaster-scenarios msp seed-library
Oct 9, 2024 Read more →

Containing lateral movement checklist

## Overview **Lateral movement** uses stolen credentials, RMM, WMI, PSRemoting, or trust relationships. Containment must **segment** without bricking...
incident-response-disaster-scenarios msp seed-library
Oct 8, 2024 Read more →

First 15 minutes of a ransomware event

## Overview The opening quarter-hour sets containment quality and legal defensibility. **Assume breach is active** until network data proves otherwise...
incident-response-disaster-scenarios msp seed-library
Oct 7, 2024 Read more →