Blackpoint SOC Response

Work a Blackpoint SOC response — the vendor specialization of security-alert-response for
Blackpoint Cyber's MDR. Their 24/7 SOC takes active response on true positives — isolating
hosts, disabling accounts — often before the MSP has read the ticket, and frequently phones the
desk. Your job is verification, follow-through and cleanup, not first response. Console
verification and restoration are technician actions you direct and record.

1. Parse the report: affected host and identity, detection detail, timestamp — and above all the
   "actions taken" section. Their report states what the SOC already did — network isolation,
   disabling the account, terminating sessions. Everything listed is contained-already;
   everything else is needs-action. Never assume their response was complete — their containment
   is scoped to what they detected, and identity cleanup and root cause are the desk's job.

2. If this started as a SOC call, get the caller's summary into the ticket verbatim first — time
   of call, analyst statements, actions they said they took. Confirm the caller really is
   Blackpoint via the documented contact path if anything is off; attackers impersonate SOCs.

3. Merge the companion storm: an active response spawns siblings — the MDR alert, the RMM's
   "device offline" from the isolation, "I can't log in" tickets, monitoring noise. Per
   alert-storm-merge and monitoring-companion-merge: same client, same window, causally linked
   to the response → merge into the primary incident ticket with exact references, keeping the
   siblings' evidence. Never merge on wording similarity alone.

4. Verify the containment claims: the technician confirms in the identity provider that the
   account is disabled and in the RMM or EDR that the isolation is in effect. A claimed
   isolation that didn't stick is the worst kind of false comfort.

5. Work what Blackpoint didn't. Their response covers the immediate threat; the desk owns
   compromised-account-containment for identity cleanup (MFA methods, app passwords, inbox
   rules, downstream sessions), edr-detection-runbook scope-checking on the isolated host, root
   cause, and client communication per defensive-writing-standard. Blackpoint act in minutes,
   but the desk's clock starts at ticket receipt — a Critical here follows the desk's Critical
   clock.

6. Coordinate restoration: releasing isolation or re-enabling the account happens after
   remediation and verification, and in agreement with their SOC — record who agreed and when.
   Never undo a Blackpoint containment to quiet user complaints; the disruption is the response
   working.

7. Note the timeline precisely — Blackpoint's actions with their timestamps versus the desk's
   with yours — and classify per soc-classification-tree. The split matters for the client
   narrative and any insurance or audit trail.