IT ISSUE · SECURITY AND THREATS
Malware alert
Most alerts mean something was stopped. The ones that matter say it could not be.Most alerts are the good outcome. Something was recognised and blocked, and the message is a record of protection working rather than a report of harm. The ones worth attention are those where the software says it couldn't act, couldn't clean or found the same thing repeatedly. If you're not sure which kind you're looking at, tell us rather than dismissing it.
Which alerts are different
- Action failed, quarantine failed, or manual removal required.
- The same detection returning after removal.
- Detections on a server rather than a workstation.
- Anything found in a shared folder rather than one profile.
- Detections at the same time as unexpected sign-ins.
What we check, and when we see it
We look at what was found, what the software did about it, whether it recurred, how it arrived and whether anything else shows the same thing.
Be clear on the timing, because it matters more than any single alert. Alerts on systems in scope are reviewed during business hours. We don't run a security operations centre, nobody is watching a screen overnight, and we don't offer continuous monitoring or threat hunting. If you need an alert acted on at two in the morning, that is a different service from a different kind of provider, and we'd rather tell you that now than after an alert has sat unread until nine.