Task
After using the previous provider’s cloud-based MDR service, an incident occurred: ransomware was not detected and stopped in time, business services were down, and rapid recovery, a clear understanding of the root causes, and a transition to more reliable monitoring were required.
What was needed was a rapid investigation with an attack timeline, an assessment of the scale of compromise, recommendations for remediating vulnerabilities, and immediate connection to round-the-clock monitoring with guaranteed SLAs.

Solution
An emergency incident-response (IR) team was formed: collection of artifacts, analysis of logs and telemetry, reconstruction of the kill chain mapped to TTPs, identification of the entry point and propagation channels, and assessment of damage and backup status.
Containment measures were carried out: isolation of hosts, revocation of compromised accounts, strengthening of policies and network segmentation; a step-by-step recovery plan was prepared.
A report was prepared: incident timeline, root causes, list of vulnerabilities and misconfigurations, a prioritized remediation plan, and recommendations for reconfiguring the IT infrastructure.
Accelerated onboarding to our monitoring center was carried out: key data sources were connected, and network-activity monitoring was configured.

Result
The client received a transparent timeline and root-cause analysis, which made it possible to close the existing vulnerabilities.
Connection to round-the-clock monitoring reduced MTTD and MTTR, decreased the volume of false positives, and reduced the workload on the IT team.
Regular reports for management on repelled attacks were introduced, and cooperation with the client’s IT department was established, which increased cyber resilience and trust in the new protection model.