Context Documents

# Security Alert Runbook

## Critical Alerts

### Ransomware Detection

- **First steps**: Isolate affected endpoints immediately
- **Evidence to collect**: Memory dump, process list, network connections
- **Escalation**: Page on-call security manager

### Data Exfiltration

- **First steps**: Block outbound connections
  ...

## Known False Positives

**IT Admin Tools**:

- `C:\AdminTools\PSExec.exe` - Used for remote management
- `C:\Scripts\Backup.ps1` - Nightly backup script
- Contact: it-team@company.com if questions

**Developer Tools**:

- Any activity from `devops_service_account`
- Debuggers in development environment

So there's this tool that the IT team uses sometimes,
it's called PSExec and it's located in the AdminTools
folder, and sometimes it triggers alerts but that's okay...

## Jira Update Format

Use this format:

**Good example**:
Severity: Critical
Evidence: VirusTotal 15/70 vendors flagged as ransomware. Observed file encryption behavior.
Recommendation: Isolate endpoint immediately.

**Bad example**:
This looks bad, probably should isolate.

# Known False Positives - SentinelOne Alerts

Last Updated: 2025-10-15

## IT Administration Tools

### PSExec (Sysinternals)

- **Hash**: a4b2c3d4e5f6...
- **Path**: C:\AdminTools\PSExec.exe
- **Reason**: Used for remote system administration
- **Approved by**: Ticket CHG-1234
- **Contact**: IT Ops team

### PowerShell Scheduled Tasks

- **Pattern**: PowerShell scripts in C:\Scripts\
- **Schedule**: Daily at 2am
- **Reason**: Automated backups and maintenance
- **Contact**: DevOps team

## Development Tools

### Visual Studio Debugger

- **Process**: vshost.exe, devenv.exe
- **Environment**: Dev workstations only
- **Reason**: Legitimate development activity

## When to Ignore These FPs

- Only on approved systems (see list below)
- During business hours (or scheduled maintenance)
- If signature hash matches exactly

If activity deviates (wrong time, wrong system), investigate further.

## Approved Systems for IT Tools

- ADMIN-01 through ADMIN-05
- DEVOPS-VM-\*

In system prompt:

Before classifying an alert as malicious, check the context
document "Known False Positives" to see if this is approved
activity. If the file hash, path, and system match the FP list,
classify as False Positive and reference the ticket number.

# Security Team Contacts

## On-Call Rotation

**Primary**:

- This week: John Smith (@john in Slack)
- Email: john@company.com
- Phone: +1-555-0100

**Backup**:

- This week: Jane Doe (@jane)
- Email: jane@company.com

## Escalation Paths

### Critical Incidents (SEV-1)

1. Page on-call via PagerDuty
2. Post to #security-incidents
3. Escalate to CISO: ciso@company.com

### High Severity (SEV-2)

1. Slack on-call in #security-alerts
2. Create incident ticket
3. If no response in 15 min, escalate to backup

### Medium/Low

1. Create ticket
2. Post in #security-alerts
3. No immediate page needed

## Team Specializations

- **Malware/Endpoint**: John, Sarah
- **Network/Infrastructure**: Mike, Lisa
- **Cloud Security**: Alex, Jordan
- **AppSec**: Chris, Taylor

## External Contacts

- **Legal/Privacy**: legal@company.com
- **Compliance**: compliance@company.com
- **PR/Comms** (for breaches): pr@company.com

In system prompt:

When escalating alerts, reference the "Security Team Contacts"
document for current on-call and escalation procedures.
Use the severity-appropriate escalation path.

# Ransomware Detection Response

## Immediate Actions (First 5 Minutes)

1. **Isolate affected endpoint(s)**
    - Use EDR containment feature
    - Block at network level if needed
2. **Stop spread**
    - Disable affected user account
    - Block suspicious IPs at firewall
3. **Alert**
    - Page on-call security
    - Post in #security-incidents
    - Create SEV-1 incident ticket

## Evidence Collection (First 15 Minutes)

Gather:

- Memory dump (if possible before isolation)
- Process list and network connections
- Recent file modifications
- Authentication logs

## Analysis Steps

1. **Identify ransomware family**
    - Check file indicators in VirusTotal
    - Look for ransom note
    - Identify encryption patterns

2. **Determine scope**
    - How many systems affected?
    - What data encrypted?
    - When did encryption start?

3. **Find patient zero**
    - First infected system
    - Initial infection vector (phishing, vuln, etc.)

## Recovery

- Do NOT pay ransom without exec approval
- Restore from backups (verify backup integrity first)
- Check with legal before any external communication

## Post-Incident

- Full incident report required
- Review and update detections
- Conduct lessons learned

In system prompt:

If you detect ransomware indicators:

1. Immediately reference "Ransomware Response Runbook"
2. Follow the immediate action steps
3. Include runbook steps in your Jira update
4. Escalate per runbook escalation procedure

## Reference Materials

You have access to these context documents:

1. **"Known False Positives"**: List of approved tools that trigger
   alerts. Check this before classifying as malicious.

2. **"Security Team Contacts"**: Current on-call rotation and
   escalation procedures. Use for all escalations.

3. **"Alert Response Runbooks"**: Procedures for different alert
   types. Follow these steps closely.

When referencing these docs, cite them in your output:
"Per the FP list, this is an approved IT tool (ticket CHG-1234)"