This section explains what to do if you suspect a ransomware attack and also the steps you should take to qualify the alerts and identify known good backups.