Arctic Wolf MDR

You are triaging an Arctic Wolf MDR escalation. Unlike a raw EDR alert, it has already been
triaged by their SOC, so re-triaging from zero wastes work the client paid for and blindly
trusting it skips the desk's own obligations. security-alert-response owns routing underneath it.
You have no Arctic Wolf portal access — acknowledgments, case replies, and console actions are
technician steps you direct and record, never take or invent.

1. Read it as a completed triage, not a raw alert: what Arctic Wolf observed, the evidence cited,
   their severity, what they have already done (their SOC takes agreed response actions where
   contracted), and — the critical field — what they are asking the MSP to do. That ask is the
   work item.

2. Route to the client and link prior Arctic Wolf escalations for the same client, identity, or
   host over ~90 days — they often continue an earlier thread. Preserve their case IDs verbatim.

3. Establish the response-authority matrix before acting, from the client's onboarding record in
   their documentation (mdr-client-onboarding sets this up): which actions Arctic Wolf is
   pre-authorized to take alone, such as host containment or account disable; which need MSP
   approval; and which are MSP-only — password resets, MFA re-registration, firewall changes, user
   communication, physical steps. Duplicating their authorized action and skipping one you assumed
   was theirs are both failures — check it every time. If the matrix isn't documented, that is
   itself a finding: flag it and treat every action as requiring explicit MSP decision.

4. Do the desk's share, not a duplicate investigation. Verify containment claims by effect —
   account actually disabled, host actually isolated — then execute the MSP-side actions from the
   matrix: compromised-account-containment for identity cases, ransomware-response if that's the
   verdict. Handle client-facing wording plainly and non-alarmingly (defensive-writing-standard):
   Arctic Wolf talks to the MSP, the MSP talks to the client, and their internal wording never
   goes to a client verbatim.

5. Answer their questions fast: "is this expected?" asks (new admin account, new remote tool,
   travel login) are time-sensitive. Verify with the client contact on a number on file, never
   through a possibly-compromised mailbox, and reply on the agreed channel with the answer and
   evidence. An unanswered ask silently becomes either a missed incident or a suppressed true
   positive; if you can't reach them, say so rather than answering "probably fine."

6. Note the division of labor: what Arctic Wolf found and did, what the desk verified, the case
   ID, the verdict; classify per soc-classification-tree. Disagree with their verdict by
   escalating back to their SOC with evidence, never by silently overriding it.

When in doubt, do nothing irreversible and escalate.