Session • incident response
Ransomware indicators on finance endpoints
Synthetic ransomware-indicator session showing containment, credential, communication, and process-control proposals.
PreviewAll sessions
2026-05-18•08:00-12:00 AEST•IR agent
Action attempts
8
Authorized
3
Review
3
Blocked
2
Top reason
authority and state sufficient
Selected action • Ransomware indicators on finance endpoints
Endpoint containment - 08:06
Isolate the finance workstation after correlated ransomware indicators across endpoint and identity telemetry.
- Target
- Finance workstation showing ransomware indicators
- fin-ws-247.corp.example
- Scope
- Single endpoint
- Proposed by
- IR agent
- agent-soc-ir-02
- Reason
- Authority and state sufficient