# What do we do with a security alert at night when nobody is on call?

Decide the rule in advance, because a small company rarely has a night shift. Write down which alerts justify waking someone, who that person is and what they may do alone: for example, isolate one workstation, but not shut down the ERP server. Everything else waits until morning, with a check at a fixed time. If you outsource monitoring, agree the same rules with the provider in writing. Make the first steps simple enough for a non-specialist: disconnect the device from the network, note the time, call the named number. Test the call chain once. NetSenX sends alerts with a plain-language reason and the hosts involved, so the person woken up can tell quickly whether it is a backup job or a workstation calling a new outside server in the small hours. It does not staff a night shift for you.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/a-security-alert-at-night-and-nobody-on-call

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Could we have seen a weekend ransomware attack coming?](https://netsenx.com/en/faq/could-we-have-seen-a-weekend-ransomware-attack-coming)
- [How much time passes between first access and encryption?](https://netsenx.com/en/faq/how-much-time-between-first-access-and-encryption)
- [How can ransomware spread through a USB stick or external drive?](https://netsenx.com/en/faq/how-can-ransomware-spread-through-a-usb-device)
- [What evidence should we keep for the insurer, the police and the regulator?](https://netsenx.com/en/faq/what-evidence-to-keep-for-insurer-police-and-regulator)
- [How long does NetSenX keep the network evidence of an incident?](https://netsenx.com/en/faq/how-long-does-netsenx-keep-incident-evidence)