If you suspect an active attack on your buisness, call our emergency hotline at: 612-399-9680
If you suspect an active attack on your business, call our emergency hotline at: 612-399-9680
Blue Team Alpha - Alpha Response logo

Create Your Incident Response & Remediation Plan

Alpha Response is our Immediate Incident Response and Remediation Service. We can have hands on keyboards within an hour. We will work around the clock to get your business back up and running, fast. 

The most common problem right now is ransomware, where all the company’s computers are shut down and the hackers demand a ransom. While Blue Team Alpha usually recommends not paying the ransom, there are unique cases where a ransom must be paid. In these instances, we work with a company that specializes in negotiating the ransom and facilitating the transaction to obtain the information decoder.

If the ransom is not paid and there are sufficient backups, Blue Team Alpha works with your IT team to get the company’s data restored. In either event, Blue Team Alpha partners with your team or your third party service provider to get your computers and network back up and running, usually within several days.

AlphaResponse Incident Response and Remediation One-Pager
Download our AlphaResponse Fact Sheet: Does Your Company Have an Incident Response Plan?

The Cost of Ransomware

  • Lost revenue
  • Lost wages
  • Legal costs
  • Lost data
  • Reputational damage
  • Penalty fees
  • Lost revenue
  • Lost wages
  • Legal costs
  • Lost data
  • Reputational damage
  • Penalty fees

How AlphaResponse Works

When you enlist our Alpha Response elite force, we will:

  • Identify the attack
  • Minimize its effect
  • Contain the damage
  • Identify the origin of the attack
  • Make recommendations to reduce the risk of future attacks
RED BLUE Cybersecurity Events

The Blue Team Alpha Methodology

1) Discovery

  • Assist and support development of action plan-based business environment, business operations, business needs, resource availability, and current state of environment
  • Preliminary analysis of email service
  • Preliminary analysis of all hardware devices
  • Determine the logs available for harvesting, retention, and review
  • Determine the size and date range of logs to audit
  • Conduct preliminary analysis of logs
  • Determine adversary lateral movement vectors within the environment
  • Monitor Incident Response tooling to identify currently unknown adversary implants and persistence capabilities
  • Assist in harvesting and preservation of logs
  • Provide technical advice

2) Identification/Analysis

  • Perform analysis on email service configurations and logs
  • Perform analysis on hardware configurations and logs
  • Perform custom queries on all endpoints to identify any malicious behaviors
  • Perform analysis on suspicious behaviors identified using industry-vetted watchlists and threat profiles
  • Review current configurations for network architecture device(s) such as switches, routers, firewalls, and other identified hardware
  • Provide technical advice

3) Containment

  • Monitor tooling for malicious code and suspicious behavior
  • Monitor email service for attempted rouge logins
  • Implement white-list(s) and black-list(s) to limit or prevent adversary activity
  • Execute (with client authorization) necessitated password resets for network and application(s)
  • Maintain accurate count of hosts with threat-hunting tooling installed and compare to validated assets lists to prevent gaps
  • Execute approved configuration changes

4) Eradication

  • Manage coverage of Incident Response tooling and implement policies to prevent malicious binary from executing
  • Remediation of malicious binaries
5) Recovery

  • Assist/support rebuilding, re-imaging, bringing machines back online and connected to the network

6) Final Report

  • Create final report
  • Gather all relevant data, findings, and information related to the incident
  • Present to client and any other appropriate parties

A One-stop Shop for All of Your Incident Response Needs

In addition to the above services, we can also assist with:

  • Ransomware negotiation
  • Bitcoin acquisition
  • Forensic investigation

Not sure if you're under attack?

Possible indicators of a cybersecurity incident include:

  • Suspicious/unexpected money transfer
  • Suspicious/unexpected vendor account change request
  • Multiple failed login attempts (brute force)
  • Abnormal remote login sessions
  • Unauthorized email forwarding rules
  • Logins from an unfamiliar domain
  • Unopenable files
  • Abnormal information system behavior
  • Increased quantity and quality of phishing attempts
  • Duplicate Invoice complaints from multiple customers
scope rz
Contact Blue Team Alpha to Create
Your Incident Response Plan