Webroot Legacy AV

Handle a legacy signature-based AV alert — written around Webroot (SecureAnywhere-era
deployments still common in MSP fleets) but applicable to any thin-telemetry AV. Two jobs:
handle the detection safely despite limited visibility, and handle the product's limits
professionally — migration-to-EDR is an account-management motion built on documented gaps, not
a scare pitch off one alert. Hands-on inspection is a technician handoff via a deep link into
the device.

1. Parse what the alert gives you — and note what it doesn't: typically threat name, file path,
   action taken (quarantined, removed, blocked) and device, with no process tree, no command
   line, no storyline. Record the visibility gap; it sets the confidence ceiling on every
   verdict below.

2. Compensate with the RMM per edr-detection-runbook: the device's live state for role and user,
   its activity timeline around the detection, and user corroboration on a verified channel.
   With thin telemetry, the RMM and the human are most of the evidence.

3. Verdict at a raised bar. A "removed" verdict on a commodity threat with corroborated benign
   context can close with evidence. Anything ambiguous — repeated detections, threats in system
   paths, signs the payload executed, credential-stealer families — cannot reach a confident
   verdict on signature-AV telemetry alone: escalate for hands-on inspection via a deep link
   into the device, and consider a second-opinion scan. Credential-exposure families branch to
   compromised-account-containment for signed-in users. "The AV says removed" never substitutes
   for scope verification on anything non-commodity.

4. Check recurrence in prior tickets (device plus threat family, ~90 days): repeated "removed"
   alerts for the same family mean removal isn't sticking — persistence the AV cannot see. That
   is a problem ticket and an escalation, never a serial close.

5. Migration framing, when the client or account manager asks or a case exposes the gap: state
   facts, not fear — what the incident showed ("the product reported removal but could not show
   what the process did, so we could not verify scope without hands-on work"), what modern EDR
   would have added (execution history, isolation, rollback), and route the commercial
   conversation to account management. Never tell a client their product "doesn't work" — it
   worked as designed; the design is the limit. Do not claim the product missed something
   without evidence it did: absence of telemetry is a visibility statement, not a miss
   statement. The buy decision is the client's.

6. Note the verdict, its confidence, and the stated visibility gaps; classify per
   soc-classification-tree. Client-facing wording per defensive-writing-standard.

With no RMM, the evidence base is the alert plus the user — say so. When in doubt do nothing
irreversible and escalate.