Technical Anshu
Tutorials Blog
🚨 Incident Response

ManageEngine Malware Alert Triage What to Do in the First 30 Minutes

The email lands: malware detected on ACCOUNTS-PC07. What you do in the next thirty minutes decides whether this stays a one-PC cleanup or becomes a network incident. This is the triage order — calm, evidence first, no heroics.

✍️ Technical Anshu🖥️ Endpoint Central Alerts⏱️ 7 minute read
🎥 Watch the full setup in the video — ManageEngine Malware Protection in Endpoint Central, step by step

ManageEngine Malware Protection does its part instantly: the file is quarantined and the alert reaches you by email or the mobile app. The human part — triage — is deciding what this detection really is and whether anything else is burning. Follow these steps in order. The order matters: isolate before you investigate, investigate before you declare it over.

Alert mail — what to read first (illustration)
DeviceACCOUNTS-PC07
File / processInvoice_Update.exe (Downloads)
Action taken● Quarantined automatically
Your first action● Isolate the device from the console

Device, file, action — three lines decide your first move. Everything else is step two.

Illustration of an alert summary. Names and files are examples.
1

Minute 0–5 — Isolate, Do Not Switch Off

  1. If the file was only quarantined and the machine is still behaving normally, you may have time to look first. If anything still looks active — pop-ups, encryption in progress, strange traffic — isolate the device from the console immediately. Isolation cuts network spread while keeping the machine on.
  2. Do not power the PC off. A running machine holds evidence in memory — the process tree, connections — that vanishes at shutdown. Isolation gives you safety without destroying evidence.
  3. Tell the user, briefly: your PC is isolated for a security check, do not restart it, use another machine for urgent work.
2

Minute 5–15 — Read What Actually Happened

  1. Open the incident in the console and read the forensics view: which file ran, what started it (email attachment? browser download? USB?), and what it touched.
  2. The MITRE ATT&CK mapping tells you the technique family — a downloader is a different problem from a credential stealer.
  3. Note the exact file name and, if shown, its hash. You will search for it in the next step.
  4. Decide the likely entry point and close it — that mailbox rule, that download, that USB stick — so a second user does not repeat the story today.
3

Minute 15–25 — Check for Spread

  1. Search the console for the same file or hash on other endpoints. One PC with a bad attachment is an incident; five is a campaign.
  2. Check whether the infected user opened the file from a shared location — a file server or shared folder means others may have run it too.
  3. If the malware is credential-stealing in nature, treat passwords as exposed: plan resets for that user's accounts, starting with email and anything financial.
4

Minute 25–30 — Decide and Record

  1. Clean and return — detection was caught at the door, no spread, machine verifies clean on a fresh full scan.
  2. Keep isolated and dig — behaviour is unexplained, or the same family reappears after cleaning. Re-imaging the PC is often faster and more certain than a third cleanup attempt.
  3. Escalate — servers involved, many endpoints, or data encryption started. That is beyond one-admin triage; bring in help and preserve evidence.
  4. Whatever you chose, write three lines in a ticket: what fired, what you found, what you did. The next alert will thank you for it.
🔌 Band karna hai to network se karo, power se nahi. Console se isolate karo — machine chalti rahegi, saboot bacha rahega, phailav ruk jayega.

🎥 Complete Setup Video Me Dekho

Alert aane par console me kya-kya dikhta hai aur kaunsi action pehle leni hai — video me poora flow hai.

▶ Watch Full Video
❓ Common Questions (FAQ)

The file was already quarantined. Is the incident over?

Not automatically. Quarantine handles the file; triage answers the bigger questions — how it got in, whether it ran, what it touched, and whether the same file exists on other machines. Those four answers close the incident.

Should I restart the infected PC to be safe?

Prefer isolating it from the console and investigating while it runs. A restart destroys in-memory evidence and, with some malware, triggers worse behaviour. Restart only as part of a cleanup step, not as a reflex.

One alert or fifty — when do I escalate?

Escalate when a server is involved, when the same malware appears on multiple endpoints, when encryption has actually started, or when you cannot explain the behaviour. Escalating early with evidence preserved is always defensible.

This guide is based on the Technical Anshu video above • Stuck on a step? Ask in the video comments — answers happen there 🙏