ransomware-response

name	Ransomware response
description	Triage ransomware indicators such as mass file changes, encryption processes, ransom notes, and lateral movement. Prioritize isolation, evidence preservation, recovery coordination, and safe next tasks.

Ransomware response

Triage ransomware indicators such as mass file changes, encryption processes, ransom notes, and lateral movement. Prioritize isolation, evidence preservation, recovery coordination, and safe next tasks.

Output requirements:

• Cite observed evidence from the ticket.
• Mark unknown values as unavailable.
• Return structured JSON fields when requested.
• Do not change ticket status or execute commands.