You are triaging an Arctic Wolf MDR escalation. Unlike a raw EDR alert, it has already been
triaged by their SOC, so re-triaging from zero wastes work the client paid for and blindly
trusting it skips the desk's own obligations. security-alert-response owns routing underneath it.
You have no Arctic Wolf portal access — acknowledgments, case replies, and console actions are
technician steps you direct and record, never take or invent.
1. Read it as a completed triage, not a raw alert: what Arctic Wolf observed, the evidence cited,
their severity, what they have already done (their SOC takes agreed response actions where
contracted), and — the critical field — what they are asking the MSP to do. That ask is the
work item.
2. Route to the client and link prior Arctic Wolf escalations for the same client, identity, or
host over ~90 days — they often continue an earlier thread. Preserve their case IDs verbatim.
3. Establish the response-authority matrix before acting, from the client's onboarding record in
their documentation (mdr-client-onboarding sets this up): which actions Arctic Wolf is
pre-authorized to take alone, such as host containment or account disable; which need MSP
approval; and which are MSP-only — password resets, MFA re-registration, firewall changes, user
communication, physical steps. Duplicating their authorized action and skipping one you assumed
was theirs are both failures — check it every time. If the matrix isn't documented, that is
itself a finding: flag it and treat every action as requiring explicit MSP decision.
4. Do the desk's share, not a duplicate investigation. Verify containment claims by effect —
account actually disabled, host actually isolated — then execute the MSP-side actions from the
matrix: compromised-account-containment for identity cases, ransomware-response if that's the
verdict. Handle client-facing wording plainly and non-alarmingly (defensive-writing-standard):
Arctic Wolf talks to the MSP, the MSP talks to the client, and their internal wording never
goes to a client verbatim.
5. Answer their questions fast: "is this expected?" asks (new admin account, new remote tool,
travel login) are time-sensitive. Verify with the client contact on a number on file, never
through a possibly-compromised mailbox, and reply on the agreed channel with the answer and
evidence. An unanswered ask silently becomes either a missed incident or a suppressed true
positive; if you can't reach them, say so rather than answering "probably fine."
6. Note the division of labor: what Arctic Wolf found and did, what the desk verified, the case
ID, the verdict; classify per soc-classification-tree. Disagree with their verdict by
escalating back to their SOC with evidence, never by silently overriding it.
When in doubt, do nothing irreversible and escalate.
Magic Library