Emergency Incident Response

What happens when you call

A clear, steady process, so your team knows what comes next.

• Tell us what you're seeing. When you reach our team, we ask focused questions to understand what's happening, what looks affected, and what you've already tried.
• Contain the damage. We help you stop the spread first: isolating affected devices, disabling compromised accounts, and revoking active sessions, while preserving the evidence you'll need later. With your authorization, we can take these actions directly in your environment.
• Investigate. We work out how the attacker got in, what they touched, and whether they still have access, using the logs and telemetry in your Microsoft environment.
• Recover and harden. We help you remove the attacker, restore safely, close the gap they used, and prepare a clear written account of what happened, coordinated with your legal counsel.

What to do right now

Whether or not you call Patriot, these steps help protect your evidence, your options, and your organization.

• Get expert help early. The first decisions in an incident are often the hardest to undo.
• Name one incident lead, and write everything down. Give one person authority to make decisions, and log every action: who did what, when, and why.
• Isolate affected devices. Disconnect them from the network, or isolate them remotely with Microsoft Defender for Endpoint. Shutting down a device that's actively encrypting files is a last resort. Note the time and tell your responders.
• Preserve your logs. Confirm Microsoft 365 unified audit logging is on, and export the audit, Entra ID sign-in, and mailbox logs you need before they age out.
• Cut off attacker access. Reset passwords for affected accounts, remove sign-in and MFA methods you don't recognize, and revoke sessions in Microsoft Entra ID. A password reset alone may not end an active session. For accounts synced from on-premises Active Directory, reset the password there.
• Look for what the attacker left behind. Check for new inbox rules, mail forwarding, newly registered MFA methods, and app consents you don't recognize. Screenshot or export what you find before you remove it.
• If money was sent, call your bank now. Ask them to try to recall the payment, and report the fraud to law enforcement.
• Call your cyber insurer and legal counsel. Some policies require prompt notice or pre-approved vendors, so check yours before committing to outside help. Counsel can advise on notification obligations.

Mistakes to avoid

General guidance only, not legal advice. Every incident is different.

• Don't wipe, reimage, or power off systems too soon. You can erase the trail that shows how the attacker got in.
• Don't delete compromised accounts or mailboxes, or the only copy of a suspicious message. Disable and block instead, and keep a sample of each malicious message before anyone purges it from other mailboxes.
• Don't let well-meaning staff make changes on their own. Keep changes with one coordinated team. Scattered fixes overwrite evidence and can tip off the attacker.
• Don't coordinate over email or Teams accounts that may be compromised. If an attacker can still read your mail or chats, they can read your response plan. Use phone or a separate channel.
• Don't pay a ransom, or contact the attacker, on your own. Payment decisions carry legal, financial, and practical risk. Talk to counsel, your insurer, and your response team first.
• Don't downplay it, or go public before you have the facts. Treat it as serious until the evidence says otherwise, and coordinate statements with counsel.
• Don't restore or rebuild too early. Recovering before you know how the attacker got in can bring back the same weakness, or the attacker.
• Don't blame the person who clicked. People who report mistakes fast are your best early warning. Keep them talking.

How Patriot helps

Hands-on incident response from a team that deploys, monitors, and hardens Microsoft security for a living.

• Triage and Containment Stop the spread: isolate compromised endpoints and servers, disable affected accounts, revoke sessions, and block malicious senders and indicators.
• Microsoft 365 and Entra ID Compromise Account takeover and business email compromise investigations: sign-in analysis, malicious inbox rules and forwarding, rogue MFA registrations, OAuth app consents, and mailbox access review.
• Ransomware Response Scope what's affected, contain the spread, and plan a clean, prioritized recovery, with your counsel and insurer in the loop on every major decision.
• Digital Forensics and Root Cause Evidence-driven investigation using the Microsoft telemetry in your environment, including Defender XDR, Sentinel, Entra ID sign-in logs, and Microsoft 365 audit logs, to establish how the attacker got in, what they accessed, and when.
• Eradication, Recovery, and Hardening Remove attacker persistence, restore safely, and close the gaps they used, including Conditional Access, MFA, privileged access, and Microsoft Defender configuration.
• Coordination and Reporting We work alongside your legal counsel, cyber insurance carrier, and leadership, and provide clear written findings to you and your counsel.

Why organizations call Patriot

Patriot is a Microsoft-focused security partner.

• Microsoft Solutions Partner for Security
• Microsoft Verified Managed XDR Solution (MXDR365)
• SOC 2 Type II certified operations and customer support
• Microsoft Intelligent Security Association (MISA) member
• Three Microsoft MVPs in-house
• U.S.-based leadership that proudly employs veterans

Strengthen your defenses now

These Patriot services add monitoring, response, and hardening to your Microsoft environment ahead of an incident.

• MXDR365: managed detection and response for your Microsoft environment, a Microsoft Verified Managed XDR Solution.
• SecureShield365: ongoing Microsoft 365 and Azure hardening and support; Gold and Platinum include Incident Response for M365 (one and two incidents).
• Security & Compliance Deployments: Microsoft Defender, Entra ID, Intune, Purview, and Sentinel deployments that close common gaps.

Emergency Incident Response FAQs