Aurora Incident Response
When every
minute counts.
Bring specialist investigation, containment and restoration together when an incident disrupts the business. Braintree helps connect Arctic Wolf’s response expertise with your Microsoft estate, decision-makers and recovery priorities.
Global security expertise. Local Microsoft depth.
Take control
of the response.
Aurora Incident Response
Incident direction
Forensics & containment
Recovery & restoration
AURORA INCIDENT RESPONSE
Make the first decisions before the crisis.
During a cyber incident, access, authority and communication can slow down the technical work. Agree how responders are engaged, who can authorise action and which systems the business needs to recover first.
01
Coordinate the response
A named Arctic Wolf incident director brings the specialist work together and keeps technical and business stakeholders informed about progress and findings.
02
Establish what happened
Digital forensic investigation gathers evidence and examines the cause, scope and impact of malicious activity so that containment and recovery decisions have a factual basis.
03
Contain and restore
Specialists can remove attacker access and support agreed restoration priorities. Investigation and business-restoration work can proceed in parallel where the incident allows.
04
Prepare before the incident
Retainer options provide planning tools and prioritised access to responders. Facilitated readiness work and a covered-incident benefit depend on the selected tier and terms.
HOW THE WORK CONNECTS
Prepare. Investigate. Contain. Recover.
JumpStart, Incident360 and Incident360 Plus have different benefits. The public guide limits its MSP purchasing model to JumpStart. Braintree confirms the purchasing route, response entitlement, readiness work and any covered incident in the proposal; response time is separate from recovery time.
01
Prepare
Agree engagement, access and escalation.
02
Investigate
Establish the activity and affected scope.
03
Contain
Authorise action to limit further impact.
04
Recover
Restore priority operations and address findings.
THE SERVICE IN PRACTICE
What your team
will work with.
A plan people can use
Record critical systems, contacts, decision rights and incident-specific runbooks. Use the readiness activities included in the chosen retainer to examine gaps.
A scoped response engagement
An incident scoping call establishes the situation and proposed work, including the applicable covered-incident benefit or response rates.
Updates for IT and the business
Follow the incident director’s progress updates, forensic findings and reports while your organisation makes the decisions needed for recovery.
Close to your business.
Braintree connects the security operation to the Microsoft estate, people and processes it needs to protect.
Microsoft integration and local implementation
Agreed service scope and response ownership
Coordination as your environment evolves
Built to see. Ready to act.
Arctic Wolf combines the Aurora Superintelligence Platform, its Agentic SOC and specialist security teams.
24×7 monitoring within the MDR service scope
AI-led investigation with human oversight
The Concierge Experience and security guidance
AURORA INCIDENT RESPONSE IN DETAIL
The detail behind the decision.
Explore the fit, implementation requirements and practical questions with your team.
01
Prepare the information needed in a crisis
Braintree’s incident-response offering with Arctic Wolf connects preparation with specialist support when a security event occurs. Readiness starts with practical information: the critical systems, the people authorised to make decisions and a way to contact them if normal communications are disrupted. The response plan should establish the business priorities that guide technical containment and recovery.
Arctic Wolf documents an incident-response planner, incident-specific runbooks and a cyber-resilience assessment. These tools provide a structure for recording the environment and reviewing preparedness. Braintree can help relate that structure to the customer’s Microsoft estate, operational teams and existing recovery arrangements.
02
Match readiness work to the purchased tier
The current vendor documentation distinguishes JumpStart, Incident360 and Incident360 Plus retainers. Incident360 options include a defined covered-incident benefit, while the Plus tier adds readiness touchpoints such as a tabletop exercise and reviews of preparedness material. The specific order and product description determine what the customer has purchased.
The purchasing arrangement also matters. Arctic Wolf’s public operational guide identifies JumpStart as the retainer available through its MSP model. Braintree confirms the applicable resale or managed-service arrangement before proposing a tier. Planning tools, a facilitated exercise, a covered incident and subsequent response work have different inclusions, so the proposal identifies each rather than treating the retainers as interchangeable.
03
Connect containment, investigation and recovery
Arctic Wolf’s incident-response overview describes securing the environment, analysing the event and restoring operations. Investigation can establish the cause and extent of malicious activity, while containment removes or limits the attacker’s access. Recovery then focuses on the systems and data needed to resume the agreed business operations.
The customer’s decision-makers remain essential. A service owner may need to authorise an outage, a system administrator may need to supply access, and business leaders may need to prioritise recovery work. The engagement should make those handovers explicit so that specialist findings can lead to decisions without unnecessary uncertainty over authority.
04
Read the benefit together with its conditions
The August 2026 retainer terms make features and the covered-incident benefit dependent on the purchased retainer. They include initial-period and pre-existing-incident restrictions, endpoint-scope conditions and prevention-tool requirements. Ransom payments are excluded. The terms also describe an incident scoping call and agreement on the response engagement.
The operational documentation identifies services that fall outside the single-incident benefit, and the product page places a limit on included restoration work. Braintree should obtain the applicable current description and terms before presenting the retainer as suitable for a specific organisation. A response-time commitment is also different from a promise that an incident will be contained or the business restored within that time.
05
Define the response operating plan
An assessment should produce a reviewable plan for activation, evidence access and decision-making. It should also distinguish the retainer from the customer’s backup, disaster-recovery, insurance and legal arrangements. Those may need to operate together during an event, but they are not interchangeable services.
Identify critical systems, recovery priorities and named business decision-makers.
Confirm the retainer tier, covered scope and the available readiness activities.
Record activation contacts, access arrangements and the route for urgent approvals.
Agree how technical findings, restoration work and business communications are coordinated.
Review the customer’s insurance notification and provider-approval requirements against its own policy.
BEFORE YOU DECIDE
Practical questions.
▸
Does every retainer include a tabletop exercise?
▸
Is the retainer available for an incident that has already started?
▸
Does a response SLA promise a recovery time?
▸
Are ransom payments part of the covered incident?
▸
Who keeps our leadership team informed during an incident?
▸
What happens after we use an Incident360 covered incident?
THE WIDER SECURITY OPERATION
Connect the next layer.
Explore the related services with your team. Each has a defined role, with product dependencies and responsibilities to agree.
01
Aurora Managed Detection & Response
Continuous monitoring and investigation across the agreed endpoint, network, cloud and identity sources.
02
Aurora Exposure Management
Discover assets, prioritise vulnerabilities and connect exposure findings to remediation.
04
Aurora Awareness & Training
Regular security learning, phishing simulations and practical follow-up for your people.
05
Aurora Endpoint Security
Endpoint protection and detection, with policies, compatibility and response ownership planned together.
06
Microsoft 365 Integration
Microsoft security signals connected to managed investigation, with the right licences and permissions.
07
Security Operations Warranty
Conditional financial protection for eligible customers, with programme enrolment and obligations defined.
BUILD YOUR BUSINESS CASE
Make the response decision before the incident.
The problem to solve.
An incident forces technical, operational and leadership decisions at the same time. Missing contacts, uncertain authority and an untested recovery path can delay action.
What success should look like.
Agree how the response will be activated, who can make decisions and how containment, investigation and recovery will be coordinated.
Bring these into the discussion.
A useful starting point for your team and the people approving the investment.
Useful reading for your proposal.
Evidence, examples and questions to take into the decision.
Insight
14 August 2026
Related recovery guidance
Test recovery as a complete failure story
Adjacent Azure resilience guidance for preparing the restoration part of a response.
Read the insight
Insight
20 August 2026
Recovery planning
Prepare the recovery network in advance
Consider networking dependencies before a workload must be restored.
Read the insight
Insight
18 February 2026
Warranty context
Understand the financial-accountability discussion
Prepare questions about the warranty alongside the operational response scope.
Read the insight
LET’S GROW.
Work through the next step with Braintree.
For planned response preparation, bring the existing plan and responsibility gaps. We can help scope the readiness work.