Bradford Health Services

Overview

Sample data

Command

Overview

Control health first, then the queue, resolution, and whether a control stopped the activity.

1 degraded · 3 watch · 2 healthy

6 investigations are open right now, 2 of them critical. Mean time to resolve in the 30-day window is 8.7h across 16 closures. Ransomware is the slowest at 16.0h. 55% of investigations opened in the window were blocked before impact.

Open investigations

6

2 critical right now

Mean resolution

8.7h

16 closures · 8h target

Blocked before impact

55%

Of investigations opened in the window

Open incidents

3

Raised from Expel for AMHS

Investigations opened and closed

Counts are small on purpose. This is an MDR queue, not an alert firehose.

  • Opened
  • Resolved

Protection by type

Blocked means a control stopped it. Detected means it was seen after the fact. Manual means a person found it.

  • Blocked
  • Detected
  • Manual

Resolution rank

Slowest type first. Average time from open to resolved. False positives are excluded. Target is 8 hours.

  1. 1. Ransomware16.0h

    2 closed · 8.0h over the 8h target

  2. 2. Insider activity15.5h

    2 closed · 7.5h over the 8h target

  3. 3. Data exfiltration13.8h

    2 closed · 5.8h over the 8h target

  4. 4. Business email7.8h

    2 closed · 15m under the 8h target

  5. 5. Command and control7.3h

    2 closed · 45m under the 8h target

  6. 6. Phishing5.0h

    2 closed · 3.0h under the 8h target

  7. 7. Malware2.8h

    2 closed · 5.2h under the 8h target

  8. 8. Suspicious login1.7h

    2 closed · 6.3h under the 8h target

Open investigations

The live queue, regardless of the time window.

  • EXP-4420

    Credential harvest sent to the shared clinical mailbox

    critical6.0h
  • EXP-4418

    Encryption stopped on an East Campus revenue workstation

    critical18.0h
  • EXP-4414

    Vendor asked accounts payable to change bank details

    high11.0h
  • EXP-4411

    Research file server sent an unusual volume of DNS

    high26.0h
  • EXP-4407

    Workstation beaconed to a newly registered host

    medium9.0h
  • EXP-4402

    Loader quarantined after a macro on a clinic PC

    medium15.0h

Open incidents

AMHS response records tied to an Expel investigation.

  • INC-1092highAndre Silva

    Vendor payment-detail change held

    EXP-4414 · opened 17 Oct 12:08 UTC

  • INC-1094criticalLina Bennett

    Contained ransomware on an East Campus workstation

    EXP-4418 · opened 17 Oct 05:08 UTC

  • INC-1090highRuth Adeyemi

    Research server DNS anomaly

    EXP-4411 · opened 16 Oct 22:08 UTC