🦠 Customer endpoint investigation and remediation runbook. Use this document to record evidence, analysis, decisions, remediation, validation, and customer communication.

📋 1. Document Information

• Customer Name:
• Incident / Ticket ID:
• Date Identified:
• Reported By: SentinelOne Automated Alert / Manual Review
• Customer Primary POC:
• Analyst Name:

💻 2. Affected Endpoint Information

• Hostname:
• Assigned User:
• Operating System:
• Public IP (if applicable):
• SentinelOne Agent Version:

🚨 3. SentinelOne Alert Review

Objective

Review, validate, and scope the security alert detected by SentinelOne.

Alert Details

• Threat Name (SentinelOne):
• Threat Type: Malware / Script Abuse / PUA / Ransomware / Other
• Severity: Low / Medium / High / Critical
• Detection Method: Behavioral AI / Static Engine / Cloud Analysis
• Detection Date & Time:
• File Name / Path:
• Parent Process (if applicable):

Analyst Observations

Examples: suspicious file location, anomalous parent process, use of LOLBins, encoded PowerShell, user execution context.

(Enter analyst notes here)

Screenshot – SentinelOne Alert

Insert SentinelOne threat alert screenshot

🔎 4. VirusTotal Threat Intelligence Review

Objective

Validate threat reputation using multi-vendor intelligence sources.

Indicators Reviewed

• File Hash (SHA256):
• Detection Ratio: e.g., 45 / 70 engines
• Threat Label / Malware Family (if identified):
• First Seen / Last Seen (if available):

Summary of VirusTotal Findings

Note consistency of detections, behavioral flags, sandbox tags, and community comments.

(Enter VirusTotal analysis notes here)

Screenshot – VirusTotal Results

Insert VirusTotal results screenshot

🧠 5. Threat Intelligence Sufficiency Check

Decision Point

Based on SentinelOne and VirusTotal data:

• VirusTotal provided sufficient intelligence to classify the threat
• VirusTotal results were inconclusive or limited → Sandbox analysis required

Justification for Decision:
(Explain why VT data was or was not sufficient)

🧪 6. ANY.RUN Behavioral Analysis (If Performed)

Note: This section is completed only when sandbox execution was required due to limited threat intelligence.

Reason for Sandbox Execution

(Explain why additional analysis was required)

Observed Behavior

Examples: persistence mechanisms, process injection, network beaconing, credential access attempts.

(Enter observed behavioral details)

Network Indicators

• Domains / IPs Contacted (if any):

(List any network indicators)

ANY.RUN Verdict

• Malicious
• Potentially Unwanted Application (PUA)
• Benign / False Positive

Screenshot – ANY.RUN Report

Insert ANY.RUN report screenshot

⚖️ 7. Determination & Risk Assessment

Final Threat Classification

• Classification: Confirmed Malware / PUA / False Positive
• Risk Level: Low / Medium / High / Critical

Scope Assessment

• Single endpoint affected
• Multiple endpoints affected
• User interaction observed
• Lateral movement identified
• No evidence of further spread

Scope Notes:

(Describe scope and impact)

🧯 8. Remediation Actions (SentinelOne)

Actions Performed

• Threat quarantined
• Threat killed / removed
• Endpoint isolated
• Endpoint isolation released
• Rollback performed (if applicable)

Policy / Security Actions

• IOC / Hash blocked globally
• Behavioral protection enforced
• SentinelOne policy adjusted to prevent recurrence

Remediation Details:

(Describe remediation steps taken)

✅ 9. Post-Remediation Validation

Verification Steps

• Follow-up scan completed
• No additional detections observed
• Endpoint operating normally

Additional Recommendations (If Applicable)

• Software or OS updates
• User security awareness reminder
• Password reset or MFA review

📝 10. Customer Executive Summary

Incident Summary (Plain Language)

(Summarize the incident in non-technical terms)

Actions Taken

(Briefly describe what was done)

Current Status

• Resolved
• Monitoring
• Pending customer action

✍️ 11. Final Status & Sign-Off

• Incident Status:

• Date Closed:

• Analyst Name:

• Customer POC Acknowledgement: